Release Notes:

Configurability:
+ aquery: `//foo:bar` now means "all configured targets with label `//foo:bar`" instead of "choose an arbitrary configured target with label `//foo:bar`". This is in line with cquery behavior. (#22135)
+ Added a new flag `--incompatible_disable_native_repo_rules` to disable native repo rule usage in WORKSPACE. All native repo rules now have a Starlark counterpart that can be used in both WORKSPACE and Bzlmod; see #22080 for more details. (#22203)
+ Starlark command-line flags can now be referred to through `alias` targets. (#22212)

ExternalDeps:
+ bzlmod `git_repository` now accepts the `strip_prefix` arg and passes it to the underlying `git_repository` call. (#22137)
+ Added a new `include()` directive to `MODULE.bazel` files, which allows the root module file to be divided into multiple segments. (#22204)
+ Fixed certain deadlocks in repo fetching with worker threads (`--experimental_worker_for_repo_fetching=auto`). (#22261)
+ `print` statements in module files are now only executed for the root module and modules subject to non-registry overrides (e.g. `local_path_override`). (#22263)
+ The new `refresh` value for `--lockfile_mode` behaves like the `update` mode, but additionally forces a refresh of mutable registry content (yanked versions and missing module versions) when switched to or from time to time while enabled. (#22371)
+ `Label` instances passed to `print` or `fail` as positional arguments are now formatted with apparent repository names (optimized for human readability). (#22460)
+ Changes to environment variables read via `getenv` now correctly invalidate module extensions. (#22541)
+ Git merge conflicts in `MODULE.bazel.lock` files can be resolved automatically. See https://bazel.build/external/lockfile#automatic-resolution for the required setup. (#22650)

OSS:
+ Bazel on Linux and BSD now respects the XDG_CACHE_HOME environment variable instead of assuming that ~/.cache/bazel is writable. (#21817)

Performance:
+ Paths in the Linux sandbox are now again identical to those outside the sandbox, even with `--incompatible_sandbox_hermetic_tmp`. (#22407)

Remote-Exec:
+ The combined coverage report produced via `--combined_report=lcov` is now announced on the BES via the new `CoverageReport` event. (#22327)
+ The compact and full execution logs now contain start times for spawns (if available). (#22341)

Rules-CPP:
+ The default Unix C++ toolchain now supports the `parse_headers` feature to validate header files with `--process_headers_in_dependencies`. (#22369)

Starlark-Interpreter:
+ Starlark `min` and `max` buitins now allow a `key` callback, similarly to `sorted`. (#21960)

Acknowledgements:

This release contains contributions from many people at Google, as well as bazel.build machine account, Brentley Jones, Cameron Martin, Daniel Wagner-Hall, Douglas Thor, Fabian Meumertzheim, George Gensure, hvd, Isaac Torres, Keith Smiley, Mark Elliot, oquenchil, Romain Chossart, Son Luong Ngoc, Spencer Putt, Thomas Weischuh, Xdng Yng, Xùdōng Yáng, Zheng Wei Tan.

Release Notes:

Configurability:
+ aquery: `//foo:bar` now means "all configured targets with label `//foo:bar`" instead of "choose an arbitrary configured target with label `//foo:bar`". This is in line with cquery behavior. (#22135)
+ Added a new flag `--incompatible_disable_native_repo_rules` to disable native repo rule usage in WORKSPACE. All native repo rules now have a Starlark counterpart that can be used in both WORKSPACE and Bzlmod; see #22080 for more details. (#22203)
+ Starlark command-line flags can now be referred to through `alias` targets. (#22212)

ExternalDeps:
+ bzlmod `git_repository` now accepts the `strip_prefix` arg and passes it to the underlying `git_repository` call. (#22137)
+ Added a new `include()` directive to `MODULE.bazel` files, which allows the root module file to be divided into multiple segments. (#22204)
+ Fixed certain deadlocks in repo fetching with worker threads (`--experimental_worker_for_repo_fetching=auto`). (#22261)
+ `print` statements in module files are now only executed for the root module and modules subject to non-registry overrides (e.g. `local_path_override`). (#22263)
+ The new `refresh` value for `--lockfile_mode` behaves like the `update` mode, but additionally forces a refresh of mutable registry content (yanked versions and missing module versions) when switched to or from time to time while enabled. (#22371)
+ `Label` instances passed to `print` or `fail` as positional arguments are now formatted with apparent repository names (optimized for human readability). (#22460)
+ Changes to environment variables read via `getenv` now correctly invalidate module extensions. (#22541)
+ Git merge conflicts in `MODULE.bazel.lock` files can be resolved automatically. See https://bazel.build/external/lockfile#automatic-resolution for the required setup. (#22650)

OSS:
+ Bazel on Linux and BSD now respects the XDG_CACHE_HOME environment variable instead of assuming that ~/.cache/bazel is writable. (#21817)

Performance:
+ Paths in the Linux sandbox are now again identical to those outside the sandbox, even with `--incompatible_sandbox_hermetic_tmp`. (#22407)

Remote-Exec:
+ The combined coverage report produced via `--combined_report=lcov` is now announced on the BES via the new `CoverageReport` event. (#22327)
+ The compact and full execution logs now contain start times for spawns (if available). (#22341)

Rules-CPP:
+ The default Unix C++ toolchain now supports the `parse_headers` feature to validate header files with `--process_headers_in_dependencies`. (#22369)

Starlark-Interpreter:
+ Starlark `min` and `max` buitins now allow a `key` callback, similarly to `sorted`. (#21960)

Acknowledgements:

This release contains contributions from many people at Google, as well as bazel.build machine account, Brentley Jones, Cameron Martin, Daniel Wagner-Hall, Douglas Thor, Fabian Meumertzheim, George Gensure, hvd, Isaac Torres, Keith Smiley, Mark Elliot, oquenchil, Romain Chossart, Son Luong Ngoc, Spencer Putt, Thomas Weischuh, Xdng Yng, Xùdōng Yáng, Zheng Wei Tan.

Release Notes:

Configurability:
+ aquery: `//foo:bar` now means "all configured targets with label `//foo:bar`" instead of "choose an arbitrary configured target with label `//foo:bar`". This is in line with cquery behavior. (bazelbuild#22135)
+ Added a new flag `--incompatible_disable_native_repo_rules` to disable native repo rule usage in WORKSPACE. All native repo rules now have a Starlark counterpart that can be used in both WORKSPACE and Bzlmod; see bazelbuild#22080 for more details. (bazelbuild#22203)
+ Starlark command-line flags can now be referred to through `alias` targets. (bazelbuild#22212)

ExternalDeps:
+ bzlmod `git_repository` now accepts the `strip_prefix` arg and passes it to the underlying `git_repository` call. (bazelbuild#22137)
+ Added a new `include()` directive to `MODULE.bazel` files, which allows the root module file to be divided into multiple segments. (bazelbuild#22204)
+ Fixed certain deadlocks in repo fetching with worker threads (`--experimental_worker_for_repo_fetching=auto`). (bazelbuild#22261)
+ `print` statements in module files are now only executed for the root module and modules subject to non-registry overrides (e.g. `local_path_override`). (bazelbuild#22263)
+ The new `refresh` value for `--lockfile_mode` behaves like the `update` mode, but additionally forces a refresh of mutable registry content (yanked versions and missing module versions) when switched to or from time to time while enabled. (bazelbuild#22371)
+ `Label` instances passed to `print` or `fail` as positional arguments are now formatted with apparent repository names (optimized for human readability). (bazelbuild#22460)
+ Changes to environment variables read via `getenv` now correctly invalidate module extensions. (bazelbuild#22541)
+ Git merge conflicts in `MODULE.bazel.lock` files can be resolved automatically. See https://bazel.build/external/lockfile#automatic-resolution for the required setup. (bazelbuild#22650)

OSS:
+ Bazel on Linux and BSD now respects the XDG_CACHE_HOME environment variable instead of assuming that ~/.cache/bazel is writable. (bazelbuild#21817)

Performance:
+ Paths in the Linux sandbox are now again identical to those outside the sandbox, even with `--incompatible_sandbox_hermetic_tmp`. (bazelbuild#22407)

Remote-Exec:
+ The combined coverage report produced via `--combined_report=lcov` is now announced on the BES via the new `CoverageReport` event. (bazelbuild#22327)
+ The compact and full execution logs now contain start times for spawns (if available). (bazelbuild#22341)

Rules-CPP:
+ The default Unix C++ toolchain now supports the `parse_headers` feature to validate header files with `--process_headers_in_dependencies`. (bazelbuild#22369)

Starlark-Interpreter:
+ Starlark `min` and `max` buitins now allow a `key` callback, similarly to `sorted`. (bazelbuild#21960)

Acknowledgements:

This release contains contributions from many people at Google, as well as bazel.build machine account, Brentley Jones, Cameron Martin, Daniel Wagner-Hall, Douglas Thor, Fabian Meumertzheim, George Gensure, hvd, Isaac Torres, Keith Smiley, Mark Elliot, oquenchil, Romain Chossart, Son Luong Ngoc, Spencer Putt, Thomas Weischuh, Xdng Yng, Xùdōng Yáng, Zheng Wei Tan.

Due to bazelbuild/bazel#21817

### What does this PR do?

Generalizes `bazel` CI configuration to make deeply nested `bazel[isk]` invocations in
`omnibus` scripts and `invoke` tasks automatically benefit from the CI configuration
(`--config=ci` as defined in `.bazelrc`).

### Motivation

**Problem with previous approach:**

GitLab cache configuration was cumbersome with deeply nested bazel invocations.
Each `variable`, `cache`, and their respective `paths` needed to be explicitly
propagated to every build job (and soon, test jobs). This created a maintenance
burden with multiple points of configuration scattered across the codebase.

**Solution:**

Centralize Bazel CI configuration in `.bazelrc` (single point of maintenance)
and propagate only two environment variables:
- `CI`: Triggers `--config=ci` in wrapper scripts
- `XDG_CACHE_HOME`: Root directory for both bazelisk and bazel caches

This allows all nested bazel invocations to automatically use:
- Remote cache configuration (from `.bazelrc`)
- (Semi-)persistent local caches
- Other CI-specific flags

### Changes

**1. Simplified wrapper scripts**

Both `tools/bazel` and `tools/bazel.bat` now:
- Require `XDG_CACHE_HOME` to be set in CI
- Validate that `XDG_CACHE_HOME` points to a directory
- Generate minimal `.user.bazelrc` with only `--config=ci`
- Use local `.cache` fallback when not in CI

**2. Standardized cache location via XDG_CACHE_HOME**

Per runner type:
- **Persistent Linux runners**: `/data/bzl` (on persistent volume)
- **Ephemeral Linux/macOS runners**: `$RUNNER_TEMP_PROJECT_DIR`
- **Windows runners**: `c:\bzl` (on persistent volume)

**3. Platform-specific implementation**

- **Linux/macOS**: Native XDG_CACHE_HOME support (Bazel 7.2.0+ / 8.4.0+)
- **Windows**: Emulated via `--output_user_root=$XDG_CACHE_HOME/bazel`

**4. Updated GitLab CI configuration**

- Introduced `.bazel:defs:posix`, `.bazel:defs:windows`, `.bazel:defs:posix-persistent`
- Removed GitLab cache configuration (replaced by persistent volumes)
- Pass `CI` and `XDG_CACHE_HOME` to all jobs, including Windows Docker containers

### Implementation Details

**Using $RUNNER_TEMP_PROJECT_DIR:**

GitLab Runner creates `$RUNNER_TEMP_PROJECT_DIR` alongside `$CI_PROJECT_DIR`
with the same lifecycle (created before job, cleaned after job). We generalized
its use based on positive experience from our earlier externalization of Bazel's
`--repo_contents_cache`, which required a directory outside the build tree to
avoid circular dependencies.

**Windows path handling:**

Windows wrapper converts backslashes to forward slashes for Bazel compatibility
(see github.com/bazelbuild/bazel/issues/3275).

**tools/bazel (POSIX):**
```bash
if [ -n "${CI:-}" ]; then
  # Validate XDG_CACHE_HOME is a directory
  # Generate user.bazelrc with --config=ci
fi
```

**tools/bazel.bat (Windows):**
```batch
if defined CI (
  # Validate XDG_CACHE_HOME is a directory
  # Set --output_user_root=%XDG_CACHE_HOME%/bazel
  # Generate user.bazelrc with --config=ci
)
```

### References

- XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/
- Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0)
- Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0)
- Bazel Windows backslash issue: bazelbuild/bazel#3275
- Windows XDG feature request: bazelbuild/bazel#27808

### What does this PR do?

Generalizes `bazel` CI configuration to make deeply nested `bazel[isk]` invocations in
`omnibus` scripts and `invoke` tasks automatically benefit from the CI configuration
(`--config=ci` as defined in `.bazelrc`).

### Motivation

**Problem with previous approach:**

GitLab cache configuration was cumbersome with deeply nested bazel invocations.
Each `variable`, `cache`, and their respective `paths` needed to be explicitly
propagated to every build job (and soon, test jobs). This created a maintenance
burden with multiple points of configuration scattered across the codebase.

**Solution:**

Centralize Bazel CI configuration in `.bazelrc` (single point of maintenance)
and propagate only two environment variables:
- `CI`: Triggers `--config=ci` in wrapper scripts
- `XDG_CACHE_HOME`: Root directory for both bazelisk and bazel caches

This allows all nested bazel invocations to automatically use:
- Remote cache configuration (from `.bazelrc`)
- (Semi-)persistent local caches
- Other CI-specific flags

### Changes

**1. Simplified wrapper scripts**

Both `tools/bazel` and `tools/bazel.bat` now:
- Require `XDG_CACHE_HOME` to be set in CI
- Validate that `XDG_CACHE_HOME` points to a directory
- Generate minimal `.user.bazelrc` with only `--config=ci`
- Use local `.cache` fallback when not in CI

**2. Standardized cache location via XDG_CACHE_HOME**

Per runner type:
- **Persistent Linux runners**: `/data/bzl` (on persistent volume)
- **Ephemeral Linux/macOS runners**: `$RUNNER_TEMP_PROJECT_DIR`
- **Windows runners**: `c:\bzl` (on persistent volume)

**3. Platform-specific implementation**

- **Linux/macOS**: Native XDG_CACHE_HOME support (Bazel 7.2.0+ / 8.4.0+)
- **Windows**: Emulated via `--output_user_root=$XDG_CACHE_HOME/bazel`

**4. Updated GitLab CI configuration**

- Introduced `.bazel:defs:posix`, `.bazel:defs:windows`, `.bazel:defs:posix-persistent`
- Removed GitLab cache configuration (replaced by persistent volumes)
- Pass `CI` and `XDG_CACHE_HOME` to all jobs, including Windows Docker containers

### Implementation Details

**Using $RUNNER_TEMP_PROJECT_DIR:**

GitLab Runner creates `$RUNNER_TEMP_PROJECT_DIR` alongside `$CI_PROJECT_DIR`
with the same lifecycle (created before job, cleaned after job). We generalized
its use based on positive experience from our earlier externalization of Bazel's
`--repo_contents_cache`, which required a directory outside the build tree to
avoid circular dependencies.

**Windows path handling:**

Windows wrapper converts backslashes to forward slashes for Bazel compatibility
(see github.com/bazelbuild/bazel/issues/3275).

**tools/bazel (POSIX):**
```bash
if [ -n "${CI:-}" ]; then
  # Validate XDG_CACHE_HOME is a directory
  # Generate user.bazelrc with --config=ci
fi
```

**tools/bazel.bat (Windows):**
```batch
if defined CI (
  # Validate XDG_CACHE_HOME is a directory
  # Set --output_user_root=%XDG_CACHE_HOME%/bazel
  # Generate user.bazelrc with --config=ci
)
```

### References

- XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/
- Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0)
- Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0)
- Bazel Windows backslash issue: bazelbuild/bazel#3275
- Windows XDG feature request: bazelbuild/bazel#27808

### What does this PR do?

Generalizes `bazel` CI configuration to make deeply nested `bazel[isk]` invocations in
`omnibus` scripts and `invoke` tasks automatically benefit from the CI configuration
(`--config=ci` as defined in `.bazelrc`).

### Motivation

**Problem with previous approach:**

GitLab cache configuration was cumbersome with deeply nested bazel invocations.
Each `variable`, `cache`, and their respective `paths` needed to be explicitly
propagated to every build job (and soon, test jobs). This created a maintenance
burden with multiple points of configuration scattered across the codebase.

**Solution:**

Centralize Bazel CI configuration in `.bazelrc` (single point of maintenance)
and propagate only two environment variables:
- `CI`: Triggers `--config=ci` in wrapper scripts
- `XDG_CACHE_HOME`: Root directory for both bazelisk and bazel caches

This allows all nested bazel invocations to automatically use:
- Remote cache configuration (from `.bazelrc`)
- (Semi-)persistent local caches
- Other CI-specific flags

### Changes

**1. Simplified wrapper scripts**

Both `tools/bazel` and `tools/bazel.bat` now:
- Require `XDG_CACHE_HOME` to be set in CI
- Validate that `XDG_CACHE_HOME` points to a directory
- Generate minimal `.user.bazelrc` with only `--config=ci`
- Use local `.cache` fallback when not in CI

**2. Standardized cache location via XDG_CACHE_HOME**

Per runner type:
- **Persistent Linux runners**: `/data/bzl` (on persistent volume)
- **Ephemeral Linux/macOS runners**: `$RUNNER_TEMP_PROJECT_DIR`
- **Windows runners**: `c:\bzl` (on persistent volume)

**3. Platform-specific implementation**

- **Linux/macOS**: Native XDG_CACHE_HOME support (Bazel 7.2.0+ / 8.4.0+)
- **Windows**: Emulated via `--output_user_root=$XDG_CACHE_HOME/bazel`

**4. Updated GitLab CI configuration**

- Introduced `.bazel:defs:posix`, `.bazel:defs:windows`, `.bazel:defs:posix-persistent`
- Removed GitLab cache configuration (replaced by persistent volumes)
- Pass `CI` and `XDG_CACHE_HOME` to all jobs, including Windows Docker containers

### Implementation Details

**Using $RUNNER_TEMP_PROJECT_DIR:**

GitLab Runner creates `$RUNNER_TEMP_PROJECT_DIR` alongside `$CI_PROJECT_DIR`
with the same lifecycle (created before job, cleaned after job). We generalized
its use based on positive experience from our earlier externalization of Bazel's
`--repo_contents_cache`, which required a directory outside the build tree to
avoid circular dependencies.

**Windows path handling:**

Windows wrapper converts backslashes to forward slashes for Bazel compatibility
(see github.com/bazelbuild/bazel/issues/3275).

**tools/bazel (POSIX):**
```bash
if [ -n "${CI:-}" ]; then
  # Validate XDG_CACHE_HOME is a directory
  # Generate user.bazelrc with --config=ci
fi
```

**tools/bazel.bat (Windows):**
```batch
if defined CI (
  # Validate XDG_CACHE_HOME is a directory
  # Set --output_user_root=%XDG_CACHE_HOME%/bazel
  # Generate user.bazelrc with --config=ci
)
```

### References

- XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/
- Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0)
- Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0)
- Bazel Windows backslash issue: bazelbuild/bazel#3275
- Windows XDG feature request: bazelbuild/bazel#27808

### What does this PR do?

Generalizes `bazel` CI configuration to make deeply nested `bazel[isk]` invocations in
`omnibus` scripts and `invoke` tasks automatically benefit from the CI configuration
(`--config=ci` as defined in `.bazelrc`).

### Motivation

**Problem with previous approach:**

GitLab cache configuration was cumbersome with deeply nested bazel invocations.
Each `variable`, `cache`, and their respective `paths` needed to be explicitly
propagated to every build job (and soon, test jobs). This created a maintenance
burden with multiple points of configuration scattered across the codebase.

**Solution:**

Centralize Bazel CI configuration in `.bazelrc` (single point of maintenance)
and propagate only two environment variables:
- `CI`: Triggers `--config=ci` in wrapper scripts
- `XDG_CACHE_HOME`: Root directory for both bazelisk and bazel caches

This allows all nested bazel invocations to automatically use:
- Remote cache configuration (from `.bazelrc`)
- (Semi-)persistent local caches
- Other CI-specific flags

### Changes

**1. Simplified wrapper scripts**

Both `tools/bazel` and `tools/bazel.bat` now:
- Require `XDG_CACHE_HOME` to be set in CI
- Validate that `XDG_CACHE_HOME` points to a directory
- Generate minimal `.user.bazelrc` with only `--config=ci`
- Use local `.cache` fallback when not in CI

**2. Standardized cache location via XDG_CACHE_HOME**

Per runner type:
- **Persistent Linux runners**: `/data/bzl` (on persistent volume)
- **Ephemeral Linux/macOS runners**: `$RUNNER_TEMP_PROJECT_DIR`
- **Windows runners**: `c:\bzl` (on persistent volume)

**3. Platform-specific implementation**

- **Linux/macOS**: Native XDG_CACHE_HOME support (Bazel 7.2.0+ / 8.4.0+)
- **Windows**: Emulated via `--output_user_root=$XDG_CACHE_HOME/bazel`

**4. Updated GitLab CI configuration**

- Introduced `.bazel:defs:posix`, `.bazel:defs:windows`, `.bazel:defs:posix-persistent`
- Removed GitLab cache configuration (replaced by persistent volumes)
- Pass `CI` and `XDG_CACHE_HOME` to all jobs, including Windows Docker containers

### Implementation Details

**Using $RUNNER_TEMP_PROJECT_DIR:**

GitLab Runner creates `$RUNNER_TEMP_PROJECT_DIR` alongside `$CI_PROJECT_DIR`
with the same lifecycle (created before job, cleaned after job). We generalized
its use based on positive experience from our earlier externalization of Bazel's
`--repo_contents_cache`, which required a directory outside the build tree to
avoid circular dependencies.

**Windows path handling:**

Windows wrapper converts backslashes to forward slashes for Bazel compatibility
(see github.com/bazelbuild/bazel/issues/3275).

**tools/bazel (POSIX):**
```bash
if [ -n "${CI:-}" ]; then
  # Validate XDG_CACHE_HOME is a directory
  # Generate user.bazelrc with --config=ci
fi
```

**tools/bazel.bat (Windows):**
```batch
if defined CI (
  # Validate XDG_CACHE_HOME is a directory
  # Set --output_user_root=%XDG_CACHE_HOME%/bazel
  # Generate user.bazelrc with --config=ci
)
```

### References

- XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/
- Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0)
- Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0)
- Bazel Windows backslash issue: bazelbuild/bazel#3275
- Windows XDG feature request: bazelbuild/bazel#27808

### What does this PR do?

Generalizes `bazel` CI configuration to make deeply nested `bazel[isk]` invocations in
`omnibus` scripts and `invoke` tasks automatically benefit from the CI configuration
(`--config=ci` as defined in `.bazelrc`).

### Motivation

**Problem with previous approach:**

GitLab cache configuration was cumbersome with deeply nested bazel invocations.
Each `variable`, `cache`, and their respective `paths` needed to be explicitly
propagated to every build job (and soon, test jobs). This created a maintenance
burden with multiple points of configuration scattered across the codebase.

**Solution:**

Centralize Bazel CI configuration in `.bazelrc` (single point of maintenance)
and propagate only two environment variables:
- `CI`: Triggers `--config=ci` in wrapper scripts
- `XDG_CACHE_HOME`: Root directory for both bazelisk and bazel caches

This allows all nested bazel invocations to automatically use:
- Remote cache configuration (from `.bazelrc`)
- (Semi-)persistent local caches
- Other CI-specific flags

### Changes

**1. Simplified wrapper scripts**

Both `tools/bazel` and `tools/bazel.bat` now:
- Require `XDG_CACHE_HOME` to be set in CI
- Validate that `XDG_CACHE_HOME` points to a directory
- Generate minimal `.user.bazelrc` with only `--config=ci`
- Use local `.cache` fallback when not in CI

**2. Standardized cache location via XDG_CACHE_HOME**

Per runner type:
- **Persistent Linux runners**: `/data/bzl` (on persistent volume)
- **Ephemeral Linux/macOS runners**: `$RUNNER_TEMP_PROJECT_DIR`
- **Windows runners**: `c:\bzl` (on persistent volume)

**3. Platform-specific implementation**

- **Linux/macOS**: Native XDG_CACHE_HOME support (Bazel 7.2.0+ / 8.4.0+)
- **Windows**: Emulated via `--output_user_root=$XDG_CACHE_HOME/bazel`

**4. Updated GitLab CI configuration**

- Introduced `.bazel:defs:posix`, `.bazel:defs:windows`, `.bazel:defs:posix-persistent`
- Removed GitLab cache configuration (replaced by persistent volumes)
- Pass `CI` and `XDG_CACHE_HOME` to all jobs, including Windows Docker containers

### Implementation Details

**Using $RUNNER_TEMP_PROJECT_DIR:**

GitLab Runner creates `$RUNNER_TEMP_PROJECT_DIR` alongside `$CI_PROJECT_DIR`
with the same lifecycle (created before job, cleaned after job). We generalized
its use based on positive experience from our earlier externalization of Bazel's
`--repo_contents_cache`, which required a directory outside the build tree to
avoid circular dependencies.

**Windows path handling:**

Windows wrapper converts backslashes to forward slashes for Bazel compatibility
(see github.com/bazelbuild/bazel/issues/3275).

**tools/bazel (POSIX):**
```bash
if [ -n "${CI:-}" ]; then
  # Validate XDG_CACHE_HOME is a directory
  # Generate user.bazelrc with --config=ci
fi
```

**tools/bazel.bat (Windows):**
```batch
if defined CI (
  # Validate XDG_CACHE_HOME is a directory
  # Set --output_user_root=%XDG_CACHE_HOME%/bazel
  # Generate user.bazelrc with --config=ci
)
```

### References

- XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/
- Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0)
- Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0)
- Bazel Windows backslash issue: bazelbuild/bazel#3275
- Windows XDG feature request: bazelbuild/bazel#27808

### What does this PR do?

Generalizes `bazel` CI configuration to make deeply nested `bazel[isk]` invocations in
`omnibus` scripts and `invoke` tasks automatically benefit from the CI configuration
(`--config=ci` as defined in `.bazelrc`).

### Motivation

**Problem with previous approach:**

GitLab cache configuration was cumbersome with deeply nested bazel invocations.
Each `variable`, `cache`, and their respective `paths` needed to be explicitly
propagated to every build job (and soon, test jobs). This created a maintenance
burden with multiple points of configuration scattered across the codebase.

**Solution:**

Centralize Bazel CI configuration in `.bazelrc` (single point of maintenance)
and propagate only two environment variables:
- `CI`: Triggers `--config=ci` in wrapper scripts
- `XDG_CACHE_HOME`: Root directory for both bazelisk and bazel caches

This allows all nested bazel invocations to automatically use:
- Remote cache configuration (from `.bazelrc`)
- (Semi-)persistent local caches
- Other CI-specific flags

### Changes

**1. Simplified wrapper scripts**

Both `tools/bazel` and `tools/bazel.bat` now:
- Require `XDG_CACHE_HOME` to be set in CI
- Validate that `XDG_CACHE_HOME` points to a directory
- Generate minimal `.user.bazelrc` with only `--config=ci`
- Use local `.cache` fallback when not in CI

**2. Standardized cache location via XDG_CACHE_HOME**

Per runner type:
- **Persistent Linux runners**: `/data/bzl` (on persistent volume)
- **Ephemeral Linux/macOS runners**: `$RUNNER_TEMP_PROJECT_DIR`
- **Windows runners**: `c:\bzl` (on persistent volume)

**3. Platform-specific implementation**

- **Linux/macOS**: Native XDG_CACHE_HOME support (Bazel 7.2.0+ / 8.4.0+)
- **Windows**: Emulated via `--output_user_root=$XDG_CACHE_HOME/bazel`

**4. Updated GitLab CI configuration**

- Introduced `.bazel:defs:posix`, `.bazel:defs:windows`, `.bazel:defs:posix-persistent`
- Removed GitLab cache configuration (replaced by persistent volumes)
- Pass `CI` and `XDG_CACHE_HOME` to all jobs, including Windows Docker containers

### Implementation Details

**Using $RUNNER_TEMP_PROJECT_DIR:**

GitLab Runner creates `$RUNNER_TEMP_PROJECT_DIR` alongside `$CI_PROJECT_DIR`
with the same lifecycle (created before job, cleaned after job). We generalized
its use based on positive experience from our earlier externalization of Bazel's
`--repo_contents_cache`, which required a directory outside the build tree to
avoid circular dependencies.

**Windows path handling:**

Windows wrapper converts backslashes to forward slashes for Bazel compatibility
(see github.com/bazelbuild/bazel/issues/3275).

**tools/bazel (POSIX):**
```bash
if [ -n "${CI:-}" ]; then
  # Validate XDG_CACHE_HOME is a directory
  # Generate user.bazelrc with --config=ci
fi
```

**tools/bazel.bat (Windows):**
```batch
if defined CI (
  # Validate XDG_CACHE_HOME is a directory
  # Set --output_user_root=%XDG_CACHE_HOME%/bazel
  # Generate user.bazelrc with --config=ci
)
```

### References

- XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/
- Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0)
- Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0)
- Bazel Windows backslash issue: bazelbuild/bazel#3275
- Windows XDG feature request: bazelbuild/bazel#27808

### What does this PR do?

Generalizes `bazel` CI configuration to make deeply nested `bazel[isk]` invocations in
`omnibus` scripts and `invoke` tasks automatically benefit from the CI configuration
(`--config=ci` as defined in `.bazelrc`).

### Motivation

**Problem with previous approach:**

GitLab cache configuration was cumbersome with deeply nested bazel invocations.
Each `variable`, `cache`, and their respective `paths` needed to be explicitly
propagated to every build job (and soon, test jobs). This created a maintenance
burden with multiple points of configuration scattered across the codebase.

**Solution:**

Centralize Bazel CI configuration in `.bazelrc` (single point of maintenance)
and propagate only two environment variables:
- `CI`: Triggers `--config=ci` in wrapper scripts
- `XDG_CACHE_HOME`: Root directory for both bazelisk and bazel caches

This allows all nested bazel invocations to automatically use:
- Remote cache configuration (from `.bazelrc`)
- (Semi-)persistent local caches
- Other CI-specific flags

### Changes

**1. Simplified wrapper scripts**

Both `tools/bazel` and `tools/bazel.bat` now:
- Require `XDG_CACHE_HOME` to be set in CI
- Validate that `XDG_CACHE_HOME` points to a directory
- Generate minimal `.user.bazelrc` with only `--config=ci`
- Use local `.cache` fallback when not in CI

**2. Standardized cache location via XDG_CACHE_HOME**

Per runner type:
- **Persistent Linux runners**: `/data/bzl` (on persistent volume)
- **Ephemeral Linux/macOS runners**: `$RUNNER_TEMP_PROJECT_DIR`
- **Windows runners**: `c:\bzl` (on persistent volume)

**3. Platform-specific implementation**

- **Linux/macOS**: Native XDG_CACHE_HOME support (Bazel 7.2.0+ / 8.4.0+)
- **Windows**: Emulated via `--output_user_root=$XDG_CACHE_HOME/bazel`

**4. Updated GitLab CI configuration**

- Introduced `.bazel:defs:posix`, `.bazel:defs:windows`, `.bazel:defs:posix-persistent`
- Removed GitLab cache configuration (replaced by persistent volumes)
- Pass `CI` and `XDG_CACHE_HOME` to all jobs, including Windows Docker containers

### Implementation Details

**Using $RUNNER_TEMP_PROJECT_DIR:**

GitLab Runner creates `$RUNNER_TEMP_PROJECT_DIR` alongside `$CI_PROJECT_DIR`
with the same lifecycle (created before job, cleaned after job). We generalized
its use based on positive experience from our earlier externalization of Bazel's
`--repo_contents_cache`, which required a directory outside the build tree to
avoid circular dependencies.

**Windows path handling:**

Windows wrapper converts backslashes to forward slashes for Bazel compatibility
(see github.com/bazelbuild/bazel/issues/3275).

**tools/bazel (POSIX):**
```bash
if [ -n "${CI:-}" ]; then
  # Validate XDG_CACHE_HOME is a directory
  # Generate user.bazelrc with --config=ci
fi
```

**tools/bazel.bat (Windows):**
```batch
if defined CI (
  # Validate XDG_CACHE_HOME is a directory
  # Set --output_user_root=%XDG_CACHE_HOME%/bazel
  # Generate user.bazelrc with --config=ci
)
```

### References

- XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/
- Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0)
- Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0)
- Bazel Windows backslash issue: bazelbuild/bazel#3275
- Windows XDG feature request: bazelbuild/bazel#27808

### What does this PR do?

Generalizes `bazel` CI configuration to make deeply nested `bazel[isk]` invocations in
`omnibus` scripts and `invoke` tasks automatically benefit from the CI configuration
(`--config=ci` as defined in `.bazelrc`).

### Motivation

**Problem with previous approach:**

GitLab cache configuration was cumbersome with deeply nested bazel invocations.
Each `variable`, `cache`, and their respective `paths` needed to be explicitly
propagated to every build job (and soon, test jobs). This created a maintenance
burden with multiple points of configuration scattered across the codebase.

**Solution:**

Centralize Bazel CI configuration in `.bazelrc` (single point of maintenance)
and propagate only two environment variables:
- `CI`: Triggers `--config=ci` in wrapper scripts
- `XDG_CACHE_HOME`: Root directory for both bazelisk and bazel caches

This allows all nested bazel invocations to automatically use:
- Remote cache configuration (from `.bazelrc`)
- (Semi-)persistent local caches
- Other CI-specific flags

### Changes

**1. Simplified wrapper scripts**

Both `tools/bazel` and `tools/bazel.bat` now:
- Require `XDG_CACHE_HOME` to be set in CI
- Validate that `XDG_CACHE_HOME` points to a directory
- Generate minimal `.user.bazelrc` with only `--config=ci`
- Use local `.cache` fallback when not in CI

**2. Standardized cache location via XDG_CACHE_HOME**

Per runner type:
- **Persistent Linux runners**: `/data/bzl` (on persistent volume)
- **Ephemeral Linux/macOS runners**: `$RUNNER_TEMP_PROJECT_DIR`
- **Windows runners**: `c:\bzl` (on persistent volume)

**3. Platform-specific implementation**

- **Linux/macOS**: Native XDG_CACHE_HOME support (Bazel 7.2.0+ / 8.4.0+)
- **Windows**: Emulated via `--output_user_root=$XDG_CACHE_HOME/bazel`

**4. Updated GitLab CI configuration**

- Introduced `.bazel:defs:posix`, `.bazel:defs:windows`, `.bazel:defs:posix-persistent`
- Removed GitLab cache configuration (replaced by persistent volumes)
- Pass `CI` and `XDG_CACHE_HOME` to all jobs, including Windows Docker containers

### Implementation Details

**Using $RUNNER_TEMP_PROJECT_DIR:**

GitLab Runner creates `$RUNNER_TEMP_PROJECT_DIR` alongside `$CI_PROJECT_DIR`
with the same lifecycle (created before job, cleaned after job). We generalized
its use based on positive experience from our earlier externalization of Bazel's
`--repo_contents_cache`, which required a directory outside the build tree to
avoid circular dependencies.

**Windows path handling:**

Windows wrapper converts backslashes to forward slashes for Bazel compatibility
(see github.com/bazelbuild/bazel/issues/3275).

**tools/bazel (POSIX):**
```bash
if [ -n "${CI:-}" ]; then
  # Validate XDG_CACHE_HOME is a directory
  # Generate user.bazelrc with --config=ci
fi
```

**tools/bazel.bat (Windows):**
```batch
if defined CI (
  # Validate XDG_CACHE_HOME is a directory
  # Set --output_user_root=%XDG_CACHE_HOME%/bazel
  # Generate user.bazelrc with --config=ci
)
```

### References

- XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/
- Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0)
- Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0)
- Bazel Windows backslash issue: bazelbuild/bazel#3275
- Windows XDG feature request: bazelbuild/bazel#27808

### What does this PR do?

Generalizes `bazel` CI configuration to make deeply nested `bazel[isk]` invocations in
`omnibus` scripts and `invoke` tasks automatically benefit from the CI configuration
(`--config=ci` as defined in `.bazelrc`).

### Motivation

**Problem with previous approach:**

GitLab cache configuration was cumbersome with deeply nested bazel invocations.
Each `variable`, `cache`, and their respective `paths` needed to be explicitly
propagated to every build job (and soon, test jobs). This created a maintenance
burden with multiple points of configuration scattered across the codebase.

**Solution:**

Centralize Bazel CI configuration in `.bazelrc` (single point of maintenance)
and propagate only two environment variables:
- `CI`: Triggers `--config=ci` in wrapper scripts
- `XDG_CACHE_HOME`: Root directory for both bazelisk and bazel caches

This allows all nested bazel invocations to automatically use:
- Remote cache configuration (from `.bazelrc`)
- (Semi-)persistent local caches
- Other CI-specific flags

### Changes

**1. Simplified wrapper scripts**

Both `tools/bazel` and `tools/bazel.bat` now:
- Require `XDG_CACHE_HOME` to be set in CI
- Validate that `XDG_CACHE_HOME` points to a directory
- Generate minimal `.user.bazelrc` with only `--config=ci`
- Use local `.cache` fallback when not in CI

**2. Standardized cache location via XDG_CACHE_HOME**

Per runner type:
- **Persistent Linux runners**: `/data/bzl` (on persistent volume)
- **Ephemeral Linux/macOS runners**: `$RUNNER_TEMP_PROJECT_DIR`
- **Windows runners**: `c:\bzl` (on persistent volume)

**3. Platform-specific implementation**

- **Linux/macOS**: Native XDG_CACHE_HOME support (Bazel 7.2.0+ / 8.4.0+)
- **Windows**: Emulated via `--output_user_root=$XDG_CACHE_HOME/bazel`

**4. Updated GitLab CI configuration**

- Introduced `.bazel:defs:posix`, `.bazel:defs:windows`, `.bazel:defs:posix-persistent`
- Removed GitLab cache configuration (replaced by persistent volumes)
- Pass `CI` and `XDG_CACHE_HOME` to all jobs, including Windows Docker containers

### Implementation Details

**Using $RUNNER_TEMP_PROJECT_DIR:**

GitLab Runner creates `$RUNNER_TEMP_PROJECT_DIR` alongside `$CI_PROJECT_DIR`
with the same lifecycle (created before job, cleaned after job). We generalized
its use based on positive experience from our earlier externalization of Bazel's
`--repo_contents_cache`, which required a directory outside the build tree to
avoid circular dependencies.

**Windows path handling:**

Windows wrapper converts backslashes to forward slashes for Bazel compatibility
(see github.com/bazelbuild/bazel/issues/3275).

**tools/bazel (POSIX):**
```bash
if [ -n "${CI:-}" ]; then
  # Validate XDG_CACHE_HOME is a directory
  # Generate user.bazelrc with --config=ci
fi
```

**tools/bazel.bat (Windows):**
```batch
if defined CI (
  # Validate XDG_CACHE_HOME is a directory
  # Set --output_user_root=%XDG_CACHE_HOME%/bazel
  # Generate user.bazelrc with --config=ci
)
```

### References

- XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/
- Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0)
- Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0)
- Bazel Windows backslash issue: bazelbuild/bazel#3275
- Windows XDG feature request: bazelbuild/bazel#27808

### What does this PR do?

Generalizes `bazel` CI configuration to make deeply nested `bazel[isk]` invocations in
`omnibus` scripts and `invoke` tasks automatically benefit from the CI configuration
(`--config=ci` as defined in `.bazelrc`).

### Motivation

**Problem with previous approach:**

GitLab cache configuration was cumbersome with deeply nested bazel invocations.
Each `variable`, `cache`, and their respective `paths` needed to be explicitly
propagated to every build job (and soon, test jobs). This created a maintenance
burden with multiple points of configuration scattered across the codebase.

**Solution:**

Centralize Bazel CI configuration in `.bazelrc` (single point of maintenance)
and propagate only two environment variables:
- `CI`: Triggers `--config=ci` in wrapper scripts
- `XDG_CACHE_HOME`: Root directory for both bazelisk and bazel caches

This allows all nested bazel invocations to automatically use:
- Remote cache configuration (from `.bazelrc`)
- (Semi-)persistent local caches
- Other CI-specific flags

### Changes

**1. Simplified wrapper scripts**

Both `tools/bazel` and `tools/bazel.bat` now:
- Require `XDG_CACHE_HOME` to be set in CI
- Validate that `XDG_CACHE_HOME` points to a directory
- Generate minimal `.user.bazelrc` with only `--config=ci`
- Use local `.cache` fallback when not in CI

**2. Standardized cache location via XDG_CACHE_HOME**

Per runner type:
- **Persistent Linux runners**: `/data/bzl` (on persistent volume)
- **Ephemeral Linux/macOS runners**: `$RUNNER_TEMP_PROJECT_DIR`
- **Windows runners**: `c:\bzl` (on persistent volume)

**3. Platform-specific implementation**

- **Linux/macOS**: Native XDG_CACHE_HOME support (Bazel 7.2.0+ / 8.4.0+)
- **Windows**: Emulated via `--output_user_root=$XDG_CACHE_HOME/bazel`

**4. Updated GitLab CI configuration**

- Introduced `.bazel:defs:posix`, `.bazel:defs:windows`, `.bazel:defs:posix-persistent`
- Removed GitLab cache configuration (replaced by persistent volumes)
- Pass `CI` and `XDG_CACHE_HOME` to all jobs, including Windows Docker containers

### Implementation Details

**Using $RUNNER_TEMP_PROJECT_DIR:**

GitLab Runner creates `$RUNNER_TEMP_PROJECT_DIR` alongside `$CI_PROJECT_DIR`
with the same lifecycle (created before job, cleaned after job). We generalized
its use based on positive experience from our earlier externalization of Bazel's
`--repo_contents_cache`, which required a directory outside the build tree to
avoid circular dependencies.

**Windows path handling:**

Windows wrapper converts backslashes to forward slashes for Bazel compatibility
(see github.com/bazelbuild/bazel/issues/3275).

**tools/bazel (POSIX):**
```bash
if [ -n "${CI:-}" ]; then
  # Validate XDG_CACHE_HOME is a directory
  # Generate user.bazelrc with --config=ci
fi
```

**tools/bazel.bat (Windows):**
```batch
if defined CI (
  # Validate XDG_CACHE_HOME is a directory
  # Set --output_user_root=%XDG_CACHE_HOME%/bazel
  # Generate user.bazelrc with --config=ci
)
```

### References

- XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/
- Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0)
- Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0)
- Bazel Windows backslash issue: bazelbuild/bazel#3275
- Windows XDG feature request: bazelbuild/bazel#27808

### What does this PR do?

Generalizes `bazel` CI configuration to make deeply nested `bazel[isk]` invocations in
`omnibus` scripts and `invoke` tasks automatically benefit from the CI configuration
(`--config=ci` as defined in `.bazelrc`).

### Motivation

**Problem with previous approach:**

GitLab cache configuration was cumbersome with deeply nested bazel invocations.
Each `variable`, `cache`, and their respective `paths` needed to be explicitly
propagated to every build job (and soon, test jobs). This created a maintenance
burden with multiple points of configuration scattered across the codebase.

**Solution:**

Centralize Bazel CI configuration in `.bazelrc` (single point of maintenance)
and propagate only two environment variables:
- `CI`: Triggers `--config=ci` in wrapper scripts
- `XDG_CACHE_HOME`: Root directory for both bazelisk and bazel caches

This allows all nested bazel invocations to automatically use:
- Remote cache configuration (from `.bazelrc`)
- (Semi-)persistent local caches
- Other CI-specific flags

### Changes

**1. Simplified wrapper scripts**

Both `tools/bazel` and `tools/bazel.bat` now:
- Require `XDG_CACHE_HOME` to be set in CI
- Validate that `XDG_CACHE_HOME` points to a directory
- Generate minimal `.user.bazelrc` with only `--config=ci`
- Use local `.cache` fallback when not in CI

**2. Standardized cache location via XDG_CACHE_HOME**

Per runner type:
- **Persistent Linux runners**: `/data/bzl` (on persistent volume)
- **Ephemeral Linux/macOS runners**: `$RUNNER_TEMP_PROJECT_DIR`
- **Windows runners**: `c:\bzl` (on persistent volume)

**3. Platform-specific implementation**

- **Linux/macOS**: Native XDG_CACHE_HOME support (Bazel 7.2.0+ / 8.4.0+)
- **Windows**: Emulated via `--output_user_root=$XDG_CACHE_HOME/bazel`

**4. Updated GitLab CI configuration**

- Introduced `.bazel:defs:posix`, `.bazel:defs:windows`, `.bazel:defs:posix-persistent`
- Removed GitLab cache configuration (replaced by persistent volumes)
- Pass `CI` and `XDG_CACHE_HOME` to all jobs, including Windows Docker containers

### Implementation Details

**Using $RUNNER_TEMP_PROJECT_DIR:**

GitLab Runner creates `$RUNNER_TEMP_PROJECT_DIR` alongside `$CI_PROJECT_DIR`
with the same lifecycle (created before job, cleaned after job). We generalized
its use based on positive experience from our earlier externalization of Bazel's
`--repo_contents_cache`, which required a directory outside the build tree to
avoid circular dependencies.

**Windows path handling:**

Windows wrapper converts backslashes to forward slashes for Bazel compatibility
(see github.com/bazelbuild/bazel/issues/3275).

**tools/bazel (POSIX):**
```bash
if [ -n "${CI:-}" ]; then
  # Validate XDG_CACHE_HOME is a directory
  # Generate user.bazelrc with --config=ci
fi
```

**tools/bazel.bat (Windows):**
```batch
if defined CI (
  # Validate XDG_CACHE_HOME is a directory
  # Set --output_user_root=%XDG_CACHE_HOME%/bazel
  # Generate user.bazelrc with --config=ci
)
```

### References

- XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/
- Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0)
- Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0)
- Bazel Windows backslash issue: bazelbuild/bazel#3275
- Windows XDG feature request: bazelbuild/bazel#27808

### What does this PR do?

Generalizes `bazel` CI configuration to make deeply nested `bazel[isk]` invocations in
`omnibus` scripts and `invoke` tasks automatically benefit from the CI configuration
(`--config=ci` as defined in `.bazelrc`).

### Motivation

**Problem with previous approach:**

GitLab cache configuration was cumbersome with deeply nested bazel invocations.
Each `variable`, `cache`, and their respective `paths` needed to be explicitly
propagated to every build job (and soon, test jobs). This created a maintenance
burden with multiple points of configuration scattered across the codebase.

**Solution:**

Centralize Bazel CI configuration in `.bazelrc` (single point of maintenance)
and propagate only two environment variables:
- `CI`: Triggers `--config=ci` in wrapper scripts
- `XDG_CACHE_HOME`: Root directory for both bazelisk and bazel caches

This allows all nested bazel invocations to automatically use:
- Remote cache configuration (from `.bazelrc`)
- (Semi-)persistent local caches
- Other CI-specific flags

### Changes

**1. Simplified wrapper scripts**

Both `tools/bazel` and `tools/bazel.bat` now:
- Require `XDG_CACHE_HOME` to be set in CI
- Validate that `XDG_CACHE_HOME` points to a directory
- Generate minimal `.user.bazelrc` with only `--config=ci`
- Use local `.cache` fallback when not in CI

**2. Standardized cache location via XDG_CACHE_HOME**

Per runner type:
- **Persistent Linux runners**: `/data/bzl` (on persistent volume)
- **Ephemeral Linux/macOS runners**: `$RUNNER_TEMP_PROJECT_DIR`
- **Windows runners**: `c:\bzl` (on persistent volume)

**3. Platform-specific implementation**

- **Linux/macOS**: Native XDG_CACHE_HOME support (Bazel 7.2.0+ / 8.4.0+)
- **Windows**: Emulated via `--output_user_root=$XDG_CACHE_HOME/bazel`

**4. Updated GitLab CI configuration**

- Introduced `.bazel:defs:posix`, `.bazel:defs:windows`, `.bazel:defs:posix-persistent`
- Removed GitLab cache configuration (replaced by persistent volumes)
- Pass `CI` and `XDG_CACHE_HOME` to all jobs, including Windows Docker containers

### Implementation Details

**Using $RUNNER_TEMP_PROJECT_DIR:**

GitLab Runner creates `$RUNNER_TEMP_PROJECT_DIR` alongside `$CI_PROJECT_DIR`
with the same lifecycle (created before job, cleaned after job). We generalized
its use based on positive experience from our earlier externalization of Bazel's
`--repo_contents_cache`, which required a directory outside the build tree to
avoid circular dependencies.

**Windows path handling:**

Windows wrapper converts backslashes to forward slashes for Bazel compatibility
(see github.com/bazelbuild/bazel/issues/3275).

**tools/bazel (POSIX):**
```bash
if [ -n "${CI:-}" ]; then
  # Validate XDG_CACHE_HOME is a directory
  # Generate user.bazelrc with --config=ci
fi
```

**tools/bazel.bat (Windows):**
```batch
if defined CI (
  # Validate XDG_CACHE_HOME is a directory
  # Set --output_user_root=%XDG_CACHE_HOME%/bazel
  # Generate user.bazelrc with --config=ci
)
```

### References

- XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/
- Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0)
- Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0)
- Bazel Windows backslash issue: bazelbuild/bazel#3275
- Windows XDG feature request: bazelbuild/bazel#27808

### What does this PR do?

Generalizes `bazel` CI configuration to make deeply nested `bazel[isk]` invocations in
`omnibus` scripts and `invoke` tasks automatically benefit from the CI configuration
(`--config=ci` as defined in `.bazelrc`).

### Motivation

**Problem with previous approach:**

GitLab cache configuration was cumbersome with deeply nested bazel invocations.
Each `variable`, `cache`, and their respective `paths` needed to be explicitly
propagated to every build job (and soon, test jobs). This created a maintenance
burden with multiple points of configuration scattered across the codebase.

**Solution:**

Centralize Bazel CI configuration in `.bazelrc` (single point of maintenance)
and propagate only two environment variables:
- `CI`: Triggers `--config=ci` in wrapper scripts
- `XDG_CACHE_HOME`: Root directory for both bazelisk and bazel caches

This allows all nested bazel invocations to automatically use:
- Remote cache configuration (from `.bazelrc`)
- (Semi-)persistent local caches
- Other CI-specific flags

### Changes

**1. Simplified wrapper scripts**

Both `tools/bazel` and `tools/bazel.bat` now:
- Require `XDG_CACHE_HOME` to be set in CI
- Validate that `XDG_CACHE_HOME` points to a directory
- Generate minimal `.user.bazelrc` with only `--config=ci`
- Use local `.cache` fallback when not in CI

**2. Standardized cache location via XDG_CACHE_HOME**

Per runner type:
- **Persistent Linux runners**: `/data/bzl` (on persistent volume)
- **Ephemeral Linux/macOS runners**: `$RUNNER_TEMP_PROJECT_DIR`
- **Windows runners**: `c:\bzl` (on persistent volume)

**3. Platform-specific implementation**

- **Linux/macOS**: Native XDG_CACHE_HOME support (Bazel 7.2.0+ / 8.4.0+)
- **Windows**: Emulated via `--output_user_root=$XDG_CACHE_HOME/bazel`

**4. Updated GitLab CI configuration**

- Introduced `.bazel:defs:posix`, `.bazel:defs:windows`, `.bazel:defs:posix-persistent`
- Removed GitLab cache configuration (replaced by persistent volumes)
- Pass `CI` and `XDG_CACHE_HOME` to all jobs, including Windows Docker containers

### Implementation Details

**Using $RUNNER_TEMP_PROJECT_DIR:**

GitLab Runner creates `$RUNNER_TEMP_PROJECT_DIR` alongside `$CI_PROJECT_DIR`
with the same lifecycle (created before job, cleaned after job). We generalized
its use based on positive experience from our earlier externalization of Bazel's
`--repo_contents_cache`, which required a directory outside the build tree to
avoid circular dependencies.

**Windows path handling:**

Windows wrapper converts backslashes to forward slashes for Bazel compatibility
(see github.com/bazelbuild/bazel/issues/3275).

**tools/bazel (POSIX):**
```bash
if [ -n "${CI:-}" ]; then
  # Validate XDG_CACHE_HOME is a directory
  # Generate user.bazelrc with --config=ci
fi
```

**tools/bazel.bat (Windows):**
```batch
if defined CI (
  # Validate XDG_CACHE_HOME is a directory
  # Set --output_user_root=%XDG_CACHE_HOME%/bazel
  # Generate user.bazelrc with --config=ci
)
```

### References

- XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/
- Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0)
- Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0)
- Bazel Windows backslash issue: bazelbuild/bazel#3275
- Windows XDG feature request: bazelbuild/bazel#27808

### What does this PR do?

Generalizes `bazel` CI configuration to make deeply nested `bazel[isk]` invocations in
`omnibus` scripts and `invoke` tasks automatically benefit from the CI configuration
(`--config=ci` as defined in `.bazelrc`).

### Motivation

**Problem with previous approach:**

GitLab cache configuration was cumbersome with deeply nested bazel invocations.
Each `variable`, `cache`, and their respective `paths` needed to be explicitly
propagated to every build job (and soon, test jobs). This created a maintenance
burden with multiple points of configuration scattered across the codebase.

**Solution:**

Centralize Bazel CI configuration in `.bazelrc` (single point of maintenance)
and propagate only two environment variables:
- `CI`: Triggers `--config=ci` in wrapper scripts
- `XDG_CACHE_HOME`: Root directory for both bazelisk and bazel caches

This allows all nested bazel invocations to automatically use:
- Remote cache configuration (from `.bazelrc`)
- (Semi-)persistent local caches
- Other CI-specific flags

### Changes

**1. Simplified wrapper scripts**

Both `tools/bazel` and `tools/bazel.bat` now:
- Require `XDG_CACHE_HOME` to be set in CI
- Validate that `XDG_CACHE_HOME` points to a directory
- Generate minimal `.user.bazelrc` with only `--config=ci`
- Use local `.cache` fallback when not in CI

**2. Standardized cache location via XDG_CACHE_HOME**

Per runner type:
- **Persistent Linux runners**: `/data/bzl` (on persistent volume)
- **Ephemeral Linux/macOS runners**: `$RUNNER_TEMP_PROJECT_DIR`
- **Windows runners**: `c:\bzl` (on persistent volume)

**3. Platform-specific implementation**

- **Linux/macOS**: Native XDG_CACHE_HOME support (Bazel 7.2.0+ / 8.4.0+)
- **Windows**: Emulated via `--output_user_root=$XDG_CACHE_HOME/bazel`

**4. Updated GitLab CI configuration**

- Introduced `.bazel:defs:posix`, `.bazel:defs:windows`, `.bazel:defs:posix-persistent`
- Removed GitLab cache configuration (replaced by persistent volumes)
- Pass `CI` and `XDG_CACHE_HOME` to all jobs, including Windows Docker containers

### Implementation Details

**Using $RUNNER_TEMP_PROJECT_DIR:**

GitLab Runner creates `$RUNNER_TEMP_PROJECT_DIR` alongside `$CI_PROJECT_DIR`
with the same lifecycle (created before job, cleaned after job). We generalized
its use based on positive experience from our earlier externalization of Bazel's
`--repo_contents_cache`, which required a directory outside the build tree to
avoid circular dependencies.

**Windows path handling:**

Windows wrapper converts backslashes to forward slashes for Bazel compatibility
(see github.com/bazelbuild/bazel/issues/3275).

**tools/bazel (POSIX):**
```bash
if [ -n "${CI:-}" ]; then
  # Validate XDG_CACHE_HOME is a directory
  # Generate user.bazelrc with --config=ci
fi
```

**tools/bazel.bat (Windows):**
```batch
if defined CI (
  # Validate XDG_CACHE_HOME is a directory
  # Set --output_user_root=%XDG_CACHE_HOME%/bazel
  # Generate user.bazelrc with --config=ci
)
```

### References

- XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/
- Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0)
- Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0)
- Bazel Windows backslash issue: bazelbuild/bazel#3275
- Windows XDG feature request: bazelbuild/bazel#27808

### What does this PR do?

Generalizes `bazel` CI configuration to make deeply nested `bazel[isk]` invocations in
`omnibus` scripts and `invoke` tasks automatically benefit from the CI configuration
(`--config=ci` as defined in `.bazelrc`).

### Motivation

**Problem with previous approach:**

GitLab cache configuration was cumbersome with deeply nested bazel invocations.
Each `variable`, `cache`, and their respective `paths` needed to be explicitly
propagated to every build job (and soon, test jobs). This created a maintenance
burden with multiple points of configuration scattered across the codebase.

**Solution:**

Centralize Bazel CI configuration in `.bazelrc` (single point of maintenance)
and propagate only two environment variables:
- `CI`: Triggers `--config=ci` in wrapper scripts
- `XDG_CACHE_HOME`: Root directory for both bazelisk and bazel caches

This allows all nested bazel invocations to automatically use:
- Remote cache configuration (from `.bazelrc`)
- (Semi-)persistent local caches
- Other CI-specific flags

### Changes

**1. Simplified wrapper scripts**

Both `tools/bazel` and `tools/bazel.bat` now:
- Require `XDG_CACHE_HOME` to be set in CI
- Validate that `XDG_CACHE_HOME` points to a directory
- Generate minimal `.user.bazelrc` with only `--config=ci`
- Use local `.cache` fallback when not in CI

**2. Standardized cache location via XDG_CACHE_HOME**

Per runner type:
- **Persistent Linux runners**: `/data/bzl` (on persistent volume)
- **Ephemeral Linux/macOS runners**: `$RUNNER_TEMP_PROJECT_DIR`
- **Windows runners**: `c:\bzl` (on persistent volume)

**3. Platform-specific implementation**

- **Linux/macOS**: Native XDG_CACHE_HOME support (Bazel 7.2.0+ / 8.4.0+)
- **Windows**: Emulated via `--output_user_root=$XDG_CACHE_HOME/bazel`

**4. Updated GitLab CI configuration**

- Introduced `.bazel:defs:posix`, `.bazel:defs:windows`, `.bazel:defs:posix-persistent`
- Removed GitLab cache configuration (replaced by persistent volumes)
- Pass `CI` and `XDG_CACHE_HOME` to all jobs, including Windows Docker containers

### Implementation Details

**Using $RUNNER_TEMP_PROJECT_DIR:**

GitLab Runner creates `$RUNNER_TEMP_PROJECT_DIR` alongside `$CI_PROJECT_DIR`
with the same lifecycle (created before job, cleaned after job). We generalized
its use based on positive experience from our earlier externalization of Bazel's
`--repo_contents_cache`, which required a directory outside the build tree to
avoid circular dependencies.

**Windows path handling:**

Windows wrapper converts backslashes to forward slashes for Bazel compatibility
(see github.com/bazelbuild/bazel/issues/3275).

**tools/bazel (POSIX):**
```bash
if [ -n "${CI:-}" ]; then
  # Validate XDG_CACHE_HOME is a directory
  # Generate user.bazelrc with --config=ci
fi
```

**tools/bazel.bat (Windows):**
```batch
if defined CI (
  # Validate XDG_CACHE_HOME is a directory
  # Set --output_user_root=%XDG_CACHE_HOME%/bazel
  # Generate user.bazelrc with --config=ci
)
```

### References

- XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/
- Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0)
- Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0)
- Bazel Windows backslash issue: bazelbuild/bazel#3275
- Windows XDG feature request: bazelbuild/bazel#27808

### What does this PR do?

Generalizes `bazel` CI configuration to make deeply nested `bazel[isk]` invocations in
`omnibus` scripts and `invoke` tasks automatically benefit from the CI configuration
(`--config=ci` as defined in `.bazelrc`).

### Motivation

**Problem with previous approach:**

GitLab cache configuration was cumbersome with deeply nested bazel invocations.
Each `variable`, `cache`, and their respective `paths` needed to be explicitly
propagated to every build job (and soon, test jobs). This created a maintenance
burden with multiple points of configuration scattered across the codebase.

**Solution:**

Centralize Bazel CI configuration in `.bazelrc` (single point of maintenance)
and propagate only two environment variables:
- `CI`: Triggers `--config=ci` in wrapper scripts
- `XDG_CACHE_HOME`: Root directory for both bazelisk and bazel caches

This allows all nested bazel invocations to automatically use:
- Remote cache configuration (from `.bazelrc`)
- (Semi-)persistent local caches
- Other CI-specific flags

### Changes

**1. Simplified wrapper scripts**

Both `tools/bazel` and `tools/bazel.bat` now:
- Require `XDG_CACHE_HOME` to be set in CI
- Validate that `XDG_CACHE_HOME` points to a directory
- Generate minimal `.user.bazelrc` with only `--config=ci`
- Use local `.cache` fallback when not in CI

**2. Standardized cache location via XDG_CACHE_HOME**

Per runner type:
- **Persistent Linux runners**: `/data/bzl` (on persistent volume)
- **Ephemeral Linux/macOS runners**: `$RUNNER_TEMP_PROJECT_DIR`
- **Windows runners**: `c:\bzl` (on persistent volume)

**3. Platform-specific implementation**

- **Linux/macOS**: Native XDG_CACHE_HOME support (Bazel 7.2.0+ / 8.4.0+)
- **Windows**: Emulated via `--output_user_root=$XDG_CACHE_HOME/bazel`

**4. Updated GitLab CI configuration**

- Introduced `.bazel:defs:posix`, `.bazel:defs:windows`, `.bazel:defs:posix-persistent`
- Removed GitLab cache configuration (replaced by persistent volumes)
- Pass `CI` and `XDG_CACHE_HOME` to all jobs, including Windows Docker containers

### Implementation Details

**Using $RUNNER_TEMP_PROJECT_DIR:**

GitLab Runner creates `$RUNNER_TEMP_PROJECT_DIR` alongside `$CI_PROJECT_DIR`
with the same lifecycle (created before job, cleaned after job). We generalized
its use based on positive experience from our earlier externalization of Bazel's
`--repo_contents_cache`, which required a directory outside the build tree to
avoid circular dependencies.

**Windows path handling:**

Windows wrapper converts backslashes to forward slashes for Bazel compatibility
(see github.com/bazelbuild/bazel/issues/3275).

**tools/bazel (POSIX):**
```bash
if [ -n "${CI:-}" ]; then
  # Validate XDG_CACHE_HOME is a directory
  # Generate user.bazelrc with --config=ci
fi
```

**tools/bazel.bat (Windows):**
```batch
if defined CI (
  # Validate XDG_CACHE_HOME is a directory
  # Set --output_user_root=%XDG_CACHE_HOME%/bazel
  # Generate user.bazelrc with --config=ci
)
```

### References

- XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/
- Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0)
- Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0)
- Bazel Windows backslash issue: bazelbuild/bazel#3275
- Windows XDG feature request: bazelbuild/bazel#27808

### What does this PR do?

Generalizes `bazel` CI configuration to make deeply nested `bazel[isk]` invocations in
`omnibus` scripts and `invoke` tasks automatically benefit from the CI configuration
(`--config=ci` as defined in `.bazelrc`).

### Motivation

**Problem with previous approach:**

GitLab cache configuration was cumbersome with deeply nested bazel invocations.
Each `variable`, `cache`, and their respective `paths` needed to be explicitly
propagated to every build job (and soon, test jobs). This created a maintenance
burden with multiple points of configuration scattered across the codebase.

**Solution:**

Centralize Bazel CI configuration in `.bazelrc` (single point of maintenance)
and propagate only two environment variables:
- `CI`: Triggers `--config=ci` in wrapper scripts
- `XDG_CACHE_HOME`: Root directory for both bazelisk and bazel caches

This allows all nested bazel invocations to automatically use:
- Remote cache configuration (from `.bazelrc`)
- (Semi-)persistent local caches
- Other CI-specific flags

### Changes

**1. Simplified wrapper scripts**

Both `tools/bazel` and `tools/bazel.bat` now:
- Require `XDG_CACHE_HOME` to be set in CI
- Validate that `XDG_CACHE_HOME` points to a directory
- Generate minimal `.user.bazelrc` with only `--config=ci`
- Use local `.cache` fallback when not in CI

**2. Standardized cache location via XDG_CACHE_HOME**

Per runner type:
- **Persistent Linux runners**: `/data/bzl` (on persistent volume)
- **Ephemeral Linux/macOS runners**: `$RUNNER_TEMP_PROJECT_DIR`
- **Windows runners**: `c:\bzl` (on persistent volume)

**3. Platform-specific implementation**

- **Linux/macOS**: Native XDG_CACHE_HOME support (Bazel 7.2.0+ / 8.4.0+)
- **Windows**: Emulated via `--output_user_root=$XDG_CACHE_HOME/bazel`

**4. Updated GitLab CI configuration**

- Introduced `.bazel:defs:posix`, `.bazel:defs:windows`, `.bazel:defs:posix-persistent`
- Removed GitLab cache configuration (replaced by persistent volumes)
- Pass `CI` and `XDG_CACHE_HOME` to all jobs, including Windows Docker containers

### Implementation Details

**Using $RUNNER_TEMP_PROJECT_DIR:**

GitLab Runner creates `$RUNNER_TEMP_PROJECT_DIR` alongside `$CI_PROJECT_DIR`
with the same lifecycle (created before job, cleaned after job). We generalized
its use based on positive experience from our earlier externalization of Bazel's
`--repo_contents_cache`, which required a directory outside the build tree to
avoid circular dependencies.

**Windows path handling:**

Windows wrapper converts backslashes to forward slashes for Bazel compatibility
(see github.com/bazelbuild/bazel/issues/3275).

**tools/bazel (POSIX):**
```bash
if [ -n "${CI:-}" ]; then
  # Validate XDG_CACHE_HOME is a directory
  # Generate user.bazelrc with --config=ci
fi
```

**tools/bazel.bat (Windows):**
```batch
if defined CI (
  # Validate XDG_CACHE_HOME is a directory
  # Set --output_user_root=%XDG_CACHE_HOME%/bazel
  # Generate user.bazelrc with --config=ci
)
```

### References

- XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/
- Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0)
- Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0)
- Bazel Windows backslash issue: bazelbuild/bazel#3275
- Windows XDG feature request: bazelbuild/bazel#27808

### What does this PR do?
It generalizes `bazel` CI configuration to make nested `bazel[isk]` invocations in `omnibus` scripts and `invoke` tasks automatically benefit from `bazel --config=ci` (single point of maintenance defined in `.bazelrc`) as well as applicable caching.

### Motivation
The GitLab cache used so far for ephemeral runners was only benefiting top-level `bazel` commands used in smoke tests and linters. It didn't benefit nested `bazel` invocations, nor were settings implied by `--config=ci` because `tools/bazel[.bat]` hook scripts had no clue they were running in CI.

The GitLab cache configuration used to be too tricky to generalize due to the many environment variables involved, that's why the present approach consists in limiting them to only 2 environment variables:
- `CI`: to trigger `bazel --config=ci`.
    The presence of this variable is anyway a _de facto_ standard leveraged by existing tools, of which in-house `dda`,
- `XDG_CACHE_HOME`: root directory for both `bazelisk` and `bazel` caches.
    Originating from Linux/BSD ecosystems, this variable is also honored by `bazel` (8.4.0+) on macOS and I filed a feature request to get it honored on Windows - meanwhile we "emulate" it there via `--output_user_root=$XDG_CACHE_HOME/bazel` (only remaining path explicitly passed to `bazel`).

### Additional Notes
1. simplified wrapper scripts:
    - require that `$XDG_CACHE_HOME` denotes a directory in CI,
    - shrunk down ephemeral `.user.bazelrc` to the bare minimum,
2. standardized cache location via `XDG_CACHE_HOME` per runner type:
    - persistent Linux runners (only used for top-level `bazel` commands): `/data/bzl` (on persistent volume), now also for AArch64 (aka ARM64),
    - "ephemeral" Linux/macOS runners: `$CI_PROJECT_DIR/.cache`, because GitLab requires cacheable paths to reside below `$CI_PROJECT_DIR`,
    - Windows runners: `c:/bzl` (but `$RUNNER_TEMP_PROJECT_DIR` should be fine too if we get rid of `msbuild`, @alopezz to confirm or deny),
3. replaced `omnibus` cache insertions by a combined cache extension comprising both `bazel` caches as well as the `omnibus` cache definition. The latter is of course aimed at vanishing at the end of the ongoing transition, hence the name: `omnibus-transition`,
4. passed `CI` to `docker run`s in order to fail if we forget to propagate `XDG_CACHE_HOME` when enabling `bazel` there.

References:
- CI environment variable semantics: https://stackoverflow.com/a/64289573
- Bazel directory structure: https://bazel.build/remote/output-directories#layout-diagram
- XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/
- Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0)
- Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0)
- Windows XDG feature request: bazelbuild/bazel#27808
- Bazel Windows backslash issue: bazelbuild/bazel#3275

Co-authored-by: regis.desgroppes <[email protected]>

### What does this PR do?
It generalizes `bazel` CI configuration to make nested `bazel[isk]` invocations in `omnibus` scripts and `invoke` tasks automatically benefit from `bazel --config=ci` (single point of maintenance defined in `.bazelrc`) as well as applicable caching.

### Motivation
The GitLab cache used so far for ephemeral runners was only benefiting top-level `bazel` commands used in smoke tests and linters. It didn't benefit nested `bazel` invocations, nor were settings implied by `--config=ci` because `tools/bazel[.bat]` hook scripts had no clue they were running in CI.

The GitLab cache configuration used to be too tricky to generalize due to the many environment variables involved, that's why the present approach consists in limiting them to only 2 environment variables:
- `CI`: to trigger `bazel --config=ci`.
    The presence of this variable is anyway a _de facto_ standard leveraged by existing tools, of which in-house `dda`,
- `XDG_CACHE_HOME`: root directory for both `bazelisk` and `bazel` caches.
    Originating from Linux/BSD ecosystems, this variable is also honored by `bazel` (8.4.0+) on macOS and I filed a feature request to get it honored on Windows - meanwhile we "emulate" it there via `--output_user_root=$XDG_CACHE_HOME/bazel` (only remaining path explicitly passed to `bazel`).

### Additional Notes
1. simplified wrapper scripts:
    - require that `$XDG_CACHE_HOME` denotes a directory in CI,
    - shrunk down ephemeral `.user.bazelrc` to the bare minimum,
2. standardized cache location via `XDG_CACHE_HOME` per runner type:
    - persistent Linux runners (only used for top-level `bazel` commands): `/data/bzl` (on persistent volume), now also for AArch64 (aka ARM64),
    - "ephemeral" Linux/macOS runners: `$CI_PROJECT_DIR/.cache`, because GitLab requires cacheable paths to reside below `$CI_PROJECT_DIR`,
    - Windows runners: `c:/bzl` (but `$RUNNER_TEMP_PROJECT_DIR` should be fine too if we get rid of `msbuild`, @alopezz to confirm or deny),
3. replaced `omnibus` cache insertions by a combined cache extension comprising both `bazel` caches as well as the `omnibus` cache definition. The latter is of course aimed at vanishing at the end of the ongoing transition, hence the name: `omnibus-transition`,
4. passed `CI` to `docker run`s in order to fail if we forget to propagate `XDG_CACHE_HOME` when enabling `bazel` there.

References:
- CI environment variable semantics: https://stackoverflow.com/a/64289573
- Bazel directory structure: https://bazel.build/remote/output-directories#layout-diagram
- XDG Base Directory Specification: https://specifications.freedesktop.org/basedir/latest/
- Bazel XDG support (Linux): bazelbuild/bazel#21817 (7.2.0)
- Bazel XDG support (macOS): bazelbuild/bazel#26773 (8.4.0)
- Windows XDG feature request: bazelbuild/bazel#27808
- Bazel Windows backslash issue: bazelbuild/bazel#3275

Co-authored-by: regis.desgroppes <[email protected]>