Add containerised BCR-style module verification (CI tier 2)

[Copilot]

Initial prototype of tier 2 verification: each changed module version is actually built against a scratch consumer workspace, BCR-style, inside a container — not a port of bcr_presubmit.py, just the ~100 lines of real test logic while keeping the presubmit.yml schema so upstream modules run unmodified.

Container — verify/Dockerfile

Derived from toolshed docker/bazel, with the updates called out in the issue:

• dropped the hardcoded security.ubuntu.com libtinfo5 pool URL; added libxml2 and libatomic1
• bazelisk 1.10.1 → 1.29.0, sha256-pinned per arch
• runs under tini so signals propagate and the bazel server doesn't outlive the container
• nothing user- or credential-specific baked in: uid/gid via runtime docker run --user, bazel version via runtime USE_BAZEL_VERSION — image stays reusable and version-agnostic

Harness — verify/verify_module.py

Runs inside the container against a read-only /registry mount:

• synthesises a consumer workspace with bazel_dep(name=<mod>, version=<version>); --registry=file://... first, BCR fallback; single_version_override pins the version under test
• workspace selection: registry test_module/ → bcr_test_module from the source archive (overlay + patches applied, strip_prefix/patch_strip honoured) → anonymous stub bazel build @<mod>//...
• full presubmit.yml schema: matrix expansion, build_targets/test_targets/build_flags/test_flags; only ubuntu* tasks are translated; a module with only non-linux tasks skips with a note rather than passing silently
• registry precedence is asserted, not assumed — bazel mod show_repo must show the module's MODULE.bazel came from the local file:// registry
• artifacts: build.log + BEP JSON per invocation into /artifacts
• RBE opt-in via RBE=1 + bind-mounted bazelrc snippet; default off, fresh clone works with zero setup

Runner — verify/verify.sh

Thin caller for local and CI use: builds the image, mounts registry ro / artifacts rw, disk+repository cache on a named volume, --cold to force the cold path (what CI runs), --bazel for the version list (default 8.x).

$ verify/verify.sh liburing 2.15.envoy
...
[verify] ✓ liburing@2.15.envoy resolved from local registry
[verify] ✓ Verified liburing@2.15.envoy (bazel 8.x)

CI wiring

Non-blocking (continue-on-error) verify job in _bazel_registry.yml, matrixed off the existing per-module version list, one docker run per job with artifacts uploaded; verify/** added to the should-run path filter (staging step 2 — make blocking later).

Test module

Hand-written test_module/ for liburing@2.15.envoy — a module with both patches and overlay — so the interesting path is exercised before generalising. The harness builds the presubmit's declared targets and builds/tests the test module's own //....

• Fixes CI tier 2 — containerised BCR-style module verification #8