Trim @bazel_tools and move dev tooling out of tools/

[fmeum]

Description

Stacked on #31144.

Now that the native rules and their autoloads are gone, a lot of what is embedded into @bazel_tools is either dead or was never referenceable from outside. This pass removes what nothing references anymore, stops embedding files that only make sense inside the Bazel repo, and moves developer tooling that never belonged in @bazel_tools into scripts/. The embedded file count drops from 292 to 259.

Removed from @bazel_tools and the repo:

• tools/whitelists and tools/build_defs/cc/whitelists/starlark_hdrs_check: the old-name package groups. Bazel has rejected the whitelist label as a transition allowlist for years and nothing references the other two. parse_headers_and_layering_check stays, rules_cc's cc_toolchain still defaults to it.
• tools/coverage: superseded by the tools/test defaults long ago; the remaining references are vendored Bazel copies.
• tools/defaults: an empty package left over from the synthesized //tools/defaults package.
• tools/build_rules/test_rules.bzl: loads a file that no longer exists.
• tools/cpp/compiler_flag.bzl and tools/jdk/java_toolchain_alias.bzl: forwarders to rules_cc and rules_java without external users. Java test mocks now load the alias macros from rules_java directly.
• tools/java:java_stub_template.txt: a deprecated alias that announced its own removal.
• tools/objc:gcov and :mcov, stubs of the native objc rules.
• The //:windows and //:windows_msvc aliases in the root package, kept for third_party code that no longer exists.
• tools/python: the py2/py3 wrapper templates and their test, and private/py_test_alias.bzl.
• tools/android: the instrumentation_test_check tool and an unreferenced platform. The module extension stays, it still has external users.
• tools/compliance: Bazel's SBOM experiment, not used by CI or the release process.

No longer embedded, but kept in the repo:

• tools/jdk: the BUILD.java_tools* templates and nosystemjdk/README; only the sources of the (now C++) proguard allowlister binary are embedded, its test runs from the repo BUILD instead of from inside @bazel_tools.
• tools/build_rules: java_rules_skylark.bzl and utilities.bzl, together with the jarhelper sources that were embedded for the native Android rules. The package no longer exists in @bazel_tools.
• src/java_tools/import_deps_checker: its embedded BUILD referenced @android_tools, which @bazel_tools cannot see, so the target could never be analyzed.
• tools/cpp/test_data: unreferenced.
• The WORKSPACE stub in the embedded tools zip.

Moved to scripts/: ctexplain, aquery_differ and the get_workspace_status example that --workspace_status_command documents.

Kept on purpose despite being legacy, because they still have users: tools/android's extension, tools/build_defs/pkg and hash, the python .bzl shims that rules_python's //:bzl target lists, and the proguard allowlister, which both rules_java and rules_android default to. bazelbuild/rules_java#382 and bazel-contrib/rules_jvm_external#1628 drop those defaults on the consumer side.

Motivation

@bazel_tools ships with every Bazel binary and is loaded by every build, so everything embedded in it is startup cost and, worse, an implicit API surface that has to be kept working. Most of the removed pieces only existed because the native Java, Python, Android and objc rules referenced them; those rules are gone, and each item was checked against Bazel's own code, the embedded files and a GitHub code search before removal.

Build API Changes

Yes, in the sense that a few targets and .bzl files disappear from @bazel_tools. All of them were either already unusable (the whitelist package groups, the import_deps_checker target), superseded for years (tools/coverage, the root //:windows aliases, the objc stubs) or explicitly deprecated (tools/java:java_stub_template.txt). Code search found no live users; the few hits are vendored Bazel copies, samples and one test fixture. There is no migration beyond switching to the replacement each item already pointed at.

Release Notes

RELNOTES[INC]: Leftovers of the removed native rules were deleted from @bazel_tools: the tools/whitelists package groups, tools/coverage, tools/cpp:compiler_flag.bzl, tools/jdk:java_toolchain_alias.bzl, tools/java:java_stub_template.txt, tools/objc:gcov and :mcov, the root //:windows aliases and the tools/build_rules package. Use the rules_cc, rules_java and tools/test targets they forwarded to.