build: run buildifier from just fmt (#28125)

## Intent

Keep Bazel and Starlark files consistently formatted without requiring
contributors to install or version buildifier themselves.

## Implementation

- Add a SHA-256-pinned, cross-platform DotSlash manifest for buildifier
v8.5.1.
- Run buildifier from the shared `just fmt` and `just fmt-check` driver,
with Windows-safe explicit DotSlash invocation.
- Provision DotSlash in formatting CI and contributor devcontainers, and
document the source-build prerequisite.
- Apply the initial mechanical buildifier formatting baseline.

sdk/python/tests/test_artifact_workflow_and_binaries.py

@@ -108,7 +108,9 @@ def test_root_fmt_recipes_use_shared_formatter_driver() -> None:
     }
     expected = {
         "working_directory": 'set working-directory := "codex-rs"',
-        "fmt_comment": "# Format the justfile, Rust, Python SDK code, and Python scripts.",
+        "fmt_comment": (
+            "# Format the justfile, Rust, Bazel/Starlark, Python SDK code, and Python scripts."
+        ),
         "fmt_commands": ["{{ python }} ../scripts/format.py"],
         "fmt_check_comment": "# Check formatting without modifying files.",
         "fmt_check_commands": ["{{ python }} ../scripts/format.py --check"],
@@ -122,20 +124,38 @@ def test_root_fmt_recipes_use_shared_formatter_driver() -> None:
     )
 
 
-def test_root_format_driver_covers_all_formatter_groups() -> None:
+def test_root_format_driver_covers_all_formatter_groups(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
     """The shared driver should retain every formatter in both modes."""
     script = _load_root_format_script_module()
+    git_ls_files_args = [
+        "git",
+        "ls-files",
+        "-z",
+        "--cached",
+        "--others",
+        "--exclude-standard",
+    ]
+
+    def fake_check_output(args, *, cwd):
+        assert args == git_ls_files_args
+        assert cwd == script.REPO_ROOT
+        return b"MODULE.bazel\0README.md\0third_party/v8/libcxx.BUILD.bazel\0"
+
+    monkeypatch.setattr(script.subprocess, "check_output", fake_check_output)
     formatters = script.formatter_groups(check=False)
     checks = script.formatter_groups(check=True)
 
     assert [group.name for group in formatters] == [
         "Just",
         "Rust",
+        "Bazel/Starlark",
         "Python SDK",
         "Python scripts",
     ]
     assert [group.name for group in checks] == [group.name for group in formatters]
-    assert [len(group.commands) for group in formatters] == [1, 1, 2, 1]
+    assert [len(group.commands) for group in formatters] == [1, 1, 1, 2, 1]
     assert [len(group.commands) for group in checks] == [
         len(group.commands) for group in formatters
     ]
@@ -157,22 +177,22 @@ def test_root_format_driver_covers_all_formatter_groups() -> None:
     )
     assert all(
         command.args[: len(sdk_uv_run_args)] == sdk_uv_run_args
-        for group in (formatters[2], checks[2])
+        for group in (formatters[3], checks[3])
         for command in group.commands
     )
     assert all(
         command.args[: len(scripts_uv_run_args)] == scripts_uv_run_args
-        for group in (formatters[3], checks[3])
+        for group in (formatters[4], checks[4])
         for command in group.commands
     )
-    assert formatters[2].commands[0].args[-5:] == (
+    assert formatters[3].commands[0].args[-5:] == (
         "ruff",
         "check",
         "--fix",
         "--fix-only",
         "sdk/python",
     )
-    assert checks[2].commands[0].args[-4:] == (
+    assert checks[3].commands[0].args[-4:] == (
         "ruff",
         "check",
         "--diff",
@@ -195,11 +215,30 @@ def test_root_format_driver_covers_all_formatter_groups() -> None:
         "imports_granularity=Item",
         "--check",
     )
-    assert [group.commands[-1].args[-3:] for group in formatters[2:]] == [
+    format_buildifier_args = formatters[2].commands[-1].args
+    check_buildifier_args = checks[2].commands[-1].args
+    assert format_buildifier_args[:4] == (
+        "dotslash",
+        str(script.REPO_ROOT / "tools" / "buildifier"),
+        "-mode=fix",
+        "-lint=off",
+    )
+    assert check_buildifier_args[:4] == (
+        "dotslash",
+        str(script.REPO_ROOT / "tools" / "buildifier"),
+        "-mode=check",
+        "-lint=off",
+    )
+    assert format_buildifier_args[4:] == check_buildifier_args[4:]
+    assert format_buildifier_args[4:] == (
+        "MODULE.bazel",
+        "third_party/v8/libcxx.BUILD.bazel",
+    )
+    assert [group.commands[-1].args[-3:] for group in formatters[3:]] == [
         ("ruff", "format", "sdk/python"),
         ("ruff", "format", "scripts"),
     ]
-    assert [group.commands[-1].args[-4:] for group in checks[2:]] == [
+    assert [group.commands[-1].args[-4:] for group in checks[3:]] == [
         ("ruff", "format", "--check", "sdk/python"),
         ("ruff", "format", "--check", "scripts"),
     ]