bazel: make public macros bzlmod-safe without repository prefixing

[Copilot]

Envoy’s public Bazel macros were resolving internal labels in the caller’s repo mapping, so downstream bzlmod consumers broke unless they passed repository = "@envoy" as a workaround. This change makes macro-internal label resolution repository-stable and replaces the repo-prefix escape hatch with explicit override points where substitution is actually legitimate.

• Replace macro-internal string labels with Label(...)

  • Converted repository + "//...", "%s//..." % repository, repo_label(...), and hard-coded @envoy//... uses in Envoy Bazel macros/helpers to Label(...).
  • Used str(Label(...)) for $(location ...) / $(rlocationpath ...) callsites so location expansion continues to work with canonical labels.
  • Applied the same fix to related Bazel helpers loaded through envoy_build_system.bzl, plus targeted Envoy Mobile-owned macro internals.

  # before
  exec_properties = exec_properties | select({
      repository + "//bazel:engflow_rbe_x86_64": {"Pool": rbe_pool} if rbe_pool else {},
      "//conditions:default": {},
  })
  
  # after
  exec_properties = exec_properties | select({
      Label("//bazel:engflow_rbe_x86_64"): {"Pool": rbe_pool} if rbe_pool else {},
      "//conditions:default": {},
  })

• Deprecate repository without silently changing override behavior

  • Public macros still accept repository for compatibility.
  • repository="" and repository="@envoy" continue to work.
  • Any other value now fails fast with a deprecation message pointing consumers at @envoy//bazel label-flag overrides.
  • Removed repository from internal helper APIs where it was only being used as a label-prefix mechanism.

• Add explicit label-flag override points

  • Added:
    • //bazel:test_main → //test:main
    • //bazel:test_pch → //test:test_pch
  • Switched macro references to these flags instead of hard-wiring the implementation target.
  • Documented the downstream override pattern in bazel/README.md.

• Expand the external bzlmod yardstick

  • Removed the repository = "@envoy" workaround from bazel/tests/external.
  • Added small external targets covering macro families including:
    • envoy_cc_library
    • envoy_cc_extension
    • envoy_cc_binary
    • envoy_cc_test
    • envoy_cc_test_library
    • envoy_cc_mock
    • envoy_cc_benchmark_binary + envoy_benchmark_test
  • Exercised envoy_select_* helpers in downstream deps.
  • Updated ci/do_ci.sh external to run bazel test //... in the external module.

• Keep adjacent downstream-facing Bazel support consistent

  • Updated related Bazel/module helpers that still pinned Envoy labels as strings.
  • Kept the existing external-module .bazelrc label-flag plumbing for quiche/proxy-wasm/libsxg so the downstream yardstick continues to reflect a real consumer setup.

• Fix a newly exposed test header dependency

  • test/test_common/test_runtime.h relied on transitive PCH-provided inclusion of absl::FlagSaver.
  • Added the direct include and corresponding BUILD dep so downstream/non-PCH compilation of benchmark/test support remains self-contained.

[repokitteh-read-only]

As a reminder, PRs marked as draft will not be automatically assigned reviewers,
or be handled by maintainer-oncall triage.

Please mark your PR as ready when you want it to be reviewed!

🐱

Caused by: #47554 was opened by Copilot.

see: more, trace.