Wire real WORKSPACE @icu/@abseil-cpp for wee8 prebuilt and align bzlmod abseil to Envoy

[Copilot]

ci-wee8 had a broken WORKSPACE path: deps.bzl still loaded/called setup_wee8_workspace_deps() after that symbol was removed from wee8_prebuilt.bzl. This change restores a real WORKSPACE dependency path for wee8 (no stubs) using Envoy’s exact ICU/Abseil pins, while keeping the existing bzlmod wiring and setup_wee8_prebuilt().

• WORKSPACE break fix (stale symbol removal)

  • Removed setup_wee8_workspace_deps from bazel/deps.bzl load/call sites.
  • Kept setup_wee8_prebuilt() in place to preserve WORKSPACE prebuilt support.

• Real external repos for wee8 transitive deps (WORKSPACE mode)

  • Added VERSIONS["abseil-cpp"]:
    • version 20260107.1
    • sha256 4314e2a7cbac89cac25a2f2322870f343d81579756ceff7f431803c2c9090195
    • GitHub archive URL/strip_prefix in existing versions.bzl style.
  • Added VERSIONS["icu"]:
    • version 78.2
    • sha256 af38c3d4904e47e1bc2dd7587922ee2aec312fefa677804582e3fecca3edb272
    • Unicode release zip URL with strip_prefix = "icu".
    • Added real BUILD overlay + patch set to expose @icu//:icu as a buildable target (no placeholder libraries).

• ICU workspace build wiring

  • Added:
    • bazel/v8/icu.BUILD.bazel
    • bazel/v8/patches/BUILD.bazel
    • ICU patch files under bazel/v8/patches/
  • This mirrors the registry-backed ICU module behavior needed for actual compile/link in WORKSPACE mode.

• bzlmod version alignment

  • Bumped bazel_dep(name = "abseil-cpp") in bazel/MODULE.bazel from 20250814.1 to 20260107.1 to match Envoy.
  • bazel mod deps abseil-cpp resolves to abseil-cpp@20260107.1.

• Why @abseil-cpp / @icu deps are load-bearing

  • wee8 prebuilt labels explicitly depend on these repos:

  deps = [
      "@abseil-cpp//absl/container:btree",
      "@abseil-cpp//absl/container:flat_hash_map",
      "@abseil-cpp//absl/container:flat_hash_set",
      "@abseil-cpp//absl/functional:overload",
      "@abseil-cpp//absl/synchronization",
      "@icu//:icu",
  ]

  • Linker output includes unresolved absl::.../ICU symbols when this dependency contract is not satisfied, confirming these deps are not analysis-only.