chore: upgrade Zig 0.12.0 → 0.16.0, Bazel 8.2.1 → 9.0.2, and modernize CI

[ajvengo]

chore: upgrade Zig 0.12.0 → 0.16.0, Bazel 8.2.1 → 9.0.2, and modernize CI

What

Upgrade three core dependencies and fix all resulting breakage:

• Zig SDK: 0.12.0 → 0.16.0 (LLVM 21, new std library APIs)
• Bazel: 8.2.1 → 9.0.2 (LTS; removes WORKSPACE, starlarkifies CC rules)
• wazero: v1.6.0 → v1.11.0

Update all downstream dependencies to Bazel 9-compatible versions:
bazel_features 1.21.0→1.45.0, platforms 0.0.10→1.0.0,
rules_cc 0.2.14→0.2.17, rules_go 0.54.0→0.60.0, gazelle 0.43.0→0.50.0

Update examples to hermetic_cc_toolchain v4.1.0 (v3.2.0 predates
Bazel 9 support; CcToolchainConfigInfo provider import is incompatible
with the starlarkified rules_cc).

Why

Zig 0.12.0 was four major versions behind, accumulating migration risk.
Bazel 9.0 is the current LTS and the ecosystem is dropping Bazel 8
compatibility. Staying on old versions blocks upstream contributions
and security fixes.

How

Zig 0.16.0 migration

• Bump VERSION and SHA256 hashes for all 6 platforms
• Adapt download URLs: Zig 0.14+ swapped archive naming from
  zig-{os}-{arch} to zig-{arch}-{os}
• Migrate zig-wrapper.zig to 0.16.0 std library: process.Init pattern,
  std.Io.Dir, process.replace, Environ.createMap, StaticStringMap,
  mem.splitScalar
• Migrate rules/cp.zig to process.Init and Io.Dir.copyFile
• Update include paths: any-macos-any→any-darwin-any,
  x86_64-linux-gnu→x86-linux-gnu, add generic-musl for WASM
• Add lib/c/** and lib/libtsan/** to linker filegroups
• Filter -mthreads in zig-wrapper (Go CGO + -Werror breakage on Windows)
• Disable ubsan (-fno-sanitize=undefined): Zig 0.16 enables it by
  default, causing linker failures when _ubsan_handle* symbols are
  referenced but the runtime library is not linked
• Remove -fsanitize-undefined-strip-path-components from debug features
  (same ubsan runtime linkage issue)
• Skip colon_link test (upstream Zig regression regression: linking using filename of .so library results in "unable to find library" from zig 0.14 ziglang/zig#23287)

Bazel 9.0.2 migration

• Migrate examples/rules_cc from WORKSPACE to bzlmod
• Delete empty WORKSPACE sentinels (root, examples/bzlmod)
• Add explicit load() for cc_binary/cc_test in BUILD files
  (Bazel 9 starlarkified built-in rules)
• Replace @local_config_platform HOST_CONSTRAINTS with [] in test/c/BUILD
• CI: rules_cc example uses override_module instead of override_repository
• Add gazelle_override for buildtools with proto disabled (newer
  buildtools references @rules_proto, unavailable from go_deps scope)

CI improvements

• Split monolithic job into 3 parallel jobs: build-and-test (matrix),
  test-examples (ubuntu), lint-and-release (ubuntu)
• Run only Windows-specific tests on windows-latest (was 15+ min
  cross-compiling all platforms; Linux/macOS already cover those)
• Skip ci/release when no git tags exist (forks)
• Remove examples/rules_cc/WORKSPACE from releaser boilerplate list

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}