chore: migrate to Aspect CLI AXL tasks on ephemeral GHA runners (#2858)

Migrate CI from Aspect Workflows (`.aspect/workflows/config.yaml`) to
the Aspect CLI on ephemeral GitHub Actions runners.

### Adds

- `.aspect/version.axl` — pins the Aspect CLI to `2026.21.44`.
- `.aspect/config.axl` — opts in to artifact uploads
(testlogs/profile/BEP), sets `--config=ci` in CI, registers an `aspect
buildifier` alias of `aspect format`.
- `.github/workflows/ci-workflows.yaml` — matrix `test` job on
(workspace × {Bazel 7, 8, 9, 9-no-execroot-entry-point}) plus single
`format` and `buildifier` jobs. Per-workspace exclusions match the
legacy config.
- `tools/format/BUILD.bazel` — `format` (multi-language) + `buildifier`
(Starlark-only) `format_multirun` targets.
- Root `//:format` and `//:buildifier` aliases into `//tools/format`.
- README note linking to the Aspect CLI docs / install.
- `rules_nodejs` bumped to 6.7.4 and `rules_go` pinned at 0.60.0 — older
versions reference the legacy global `CcInfo` removed in Bazel 9.
- `common:ci --lockfile_mode=off` (+ build-without-bytes flags) in each
e2e / examples sub-workspace `.bazelrc` so they don't trip the preset's
strict lockfile mode under `:ci` when run from their own workspace root.

### Removes / renames

- `.aspect/workflows/config.yaml` and `.aspect/workflows/bazelrc` —
bazelrc settings hoisted into root `.bazelrc` under `:ci` with
`--lockfile_mode=off` (lock is gitignored).
- `.github/workflows/ci.yaml` → `ci-vanilla-bazel.yaml` (kept as the
vanilla-bazel matrix).
- `.github/workflows/buildifier.yaml` (replaced by the `buildifier` job
in `ci-workflows.yaml`).
- Root `//:buildifier` / `//:buildifier.check` rules (moved into
`tools/format`).

### Notes

- Bazel 9 variants pin `9.0.2` rather than `9.x` until
[bazelbuild/bazel#29393](https://github.com/bazelbuild/bazel/issues/29393)
is fixed (carried over from the legacy config).

---

### Changes are visible to end-users: no

### Test plan

- CI on this PR