build: run buildifier from just fmt (#28125)

## Intent

Keep Bazel and Starlark files consistently formatted without requiring
contributors to install or version buildifier themselves.

## Implementation

- Add a SHA-256-pinned, cross-platform DotSlash manifest for buildifier
v8.5.1.
- Run buildifier from the shared `just fmt` and `just fmt-check` driver,
with Windows-safe explicit DotSlash invocation.
- Provision DotSlash in formatting CI and contributor devcontainers, and
document the source-build prerequisite.
- Apply the initial mechanical buildifier formatting baseline.

rbe.bzl

@@ -31,10 +31,10 @@ platform(
     visibility = ["//visibility:public"],
 )
 """.format(
-    cpu = cpu,
-    arch = exec_arch,
-    image_sha = image_sha
-))
+        cpu = cpu,
+        arch = exec_arch,
+        image_sha = image_sha,
+    ))
 
 rbe_platform_repository = repository_rule(
     implementation = _rbe_platform_repo_impl,