test: guard Bazel workflow uv setup

[haasonsaas]

Summary

• add a pytest contract that fails if the Bazel RBE workflow stops installing uv before make bazel-check
• include the workflow file in Bazel pytest runfiles so the guard also runs under Bazel
• closes the workflow-shell-footgun guardrail gap from [codex] Guardrail backlog: Workflow shell footgun (workflow-shell-footgun) .github#69 / ci: add Bazel RBE lane #9

Verification

• git diff --check
• uv run --extra test pytest -q tests/test_bazel_workflow_contract.py

Note

• bazelisk is not installed locally in this Codex environment, so CI is the Bazel verification authority for this PR.

[cursor]

PR Summary

Low Risk
Low risk: adds a lightweight test and Bazel runfiles data wiring with no production code changes. Potential risk is only increased test brittleness if the workflow text changes.

Overview
Adds a new pytest contract (tests/test_bazel_workflow_contract.py) that asserts .github/workflows/bazel-rbe.yml contains astral-sh/setup-uv before make bazel-check, preventing accidental CI breakage due to step reordering.

Updates BUILD.bazel to include the workflow YAML in the py_test data runfiles so the guard runs under Bazel as well as plain pytest.

^{Reviewed by Cursor Bugbot for commit 9942f1e. Bugbot is set up for automated code reviews on this repo. Configure here.}