build: run buildifier from just fmt (#28125)

## Intent

Keep Bazel and Starlark files consistently formatted without requiring
contributors to install or version buildifier themselves.

## Implementation

- Add a SHA-256-pinned, cross-platform DotSlash manifest for buildifier
v8.5.1.
- Run buildifier from the shared `just fmt` and `just fmt-check` driver,
with Windows-safe explicit DotSlash invocation.
- Provision DotSlash in formatting CI and contributor devcontainers, and
document the source-build prerequisite.
- Apply the initial mechanical buildifier formatting baseline.

codex-rs/exec-server/BUILD.bazel

@@ -6,15 +6,15 @@ codex_rust_crate(
     deps_extra = [
         "@crates//:toml",
     ],
+    extra_binaries = [
+        "//codex-rs/bwrap:bwrap",
+    ],
+    integration_compile_data_extra = [
+        "src/proto/codex.exec_server.relay.v1.rs",
+    ],
     # Keep the crate's integration tests single-threaded under Bazel because
     # they install process-global test-binary dispatch state, and the remote
     # exec-server cases already rely on serialization around the full CLI path.
     integration_test_args = ["--test-threads=1"],
-    integration_compile_data_extra = [
-        "src/proto/codex.exec_server.relay.v1.rs",
-    ],
-    extra_binaries = [
-        "//codex-rs/bwrap:bwrap",
-    ],
     test_tags = ["no-sandbox"],
 )