[build] Update to Bazel 9.1.0, perform build cleanup

[fhanau]

• Update Bazel, this includes several performance/memory usage improvements. Release notes: https://github.com/bazelbuild/bazel/releases/tag/9.1.0
• Do not mark weakref test as flaky – the test is evidently not flaky in workerd where we don't re-run tests, and having any tests marked as flaky in workerd can slow down internal CI runs that will have to fetch workerd even if they only need to run tests in the flaky cordon
• Simplify coverage configuration – based on a close look at the rules_cc and bazel repos, we define several things more than once, we can remove some coverage overrides in .bazelrc. The additional tests added in [9.1.0] Allow --test_env / env= to override coverage env (https://github.com/bazelbuild/bazel/pull/29110) bazelbuild/bazel#29169 were helpful in better understanding this.
• Update pnpm/action-setup to a version based on Node22 to avoid Node20 deprecation warnings
• Remove obsolete typescript hash definition
• Adjust bazelmod mangled paths to facilitate internal changes

Also see the downstream PR.

Reviewers: Convince yourself that the coverage percentage is unchanged (see report in https://app.codecov.io/github/cloudflare/workerd/commit/c05b200a01ce30d0c39ba40c7c6d0ed30cd9b2de) and look at the internal changes for context.

[ask-bonk]

All the changes look clean and straightforward. Let me verify there's nothing else I should check — specifically, that the --action_env=COVERAGE_GCOV_PATH removal is safe (i.e., --repo_env properly covers it), and that the experimental_generate_llvm_lcov flag indeed replaces the old GENERATE_LLVM_LCOV=1 test_env approach.

The diff is clean. Let me summarize my findings:

1. Bazel 9.0.1 -> 9.1.0: Version bump, straightforward.
2. Coverage config simplification: Removed redundant --action_env and --test_env settings. In Bazel, --repo_env sets variables for both repository rules and actions. The --experimental_generate_llvm_lcov flag replaces the manual GENERATE_LLVM_LCOV=1 test env, and BAZEL_LLVM_COV via --repo_env replaces the LLVM_COV test env. The comment update correctly reflects this.
3. pnpm/action-setup v4 -> v5: Node22-based, avoids deprecation warnings.
4. BoringSSL unpin: Removed freeze_version, updated to 0.20260413.0. The PR body explains the rationale.
5. TypeScript integrity hash removal: The comment says it was needed for TS 6.0.2 not being mirrored in rules_ts, now presumably resolved.
6. Weakref test flaky=True removal: PR body explains the rationale clearly.

None of these changes introduce logic bugs, security issues, backward compatibility violations, or other actionable problems. All changes are build/CI configuration — no runtime code is affected.

LGTM

github run