Add Bazel RBE lane

[haasonsaas]

Summary

• add Bazel/Bzlmod/Gazelle coverage for the Go packages in keep
• add a repo-scoped Bazel RBE smoke workflow using the evalops-keep-rbe runner label
• wire Makefile helpers for local, generated-graph, and remote Buildfarm smoke checks

Test plan

• actionlint .github/workflows/ci.yml .github/workflows/bazel-rbe.yml .github/workflows/security.yml .github/workflows/deploy.yml .github/workflows/smoke-tests.yml
• go test ./... -count=1
• make bazel-test
• make bazel-check

[cursor]

PR Summary

Medium Risk
Medium risk because it introduces a new Bazel-based build/test lane (including remote execution via Buildfarm) and updates CI/Makefile tooling, which can affect developer and CI build behavior even though application runtime code is untouched.

Overview
Adds a Bazel/Bzlmod build setup for the Go codebase, including workspace-level MODULE.bazel/lockfile, gazelle integration, and per-package BUILD.bazel targets (binaries and tests), plus a custom Linux GCC toolchain for remote execution.

Introduces a repo-scoped Bazel RBE smoke lane: new .bazelrc remote-execution configs, a GitHub Actions workflow (bazel-rbe.yml) pinned to the evalops-keep-rbe self-hosted runner label, and a scripts/run-bazel-rbe.sh helper that establishes/validates an SSH/IAP tunnel before running remote Bazel tests.

Extends the Makefile with bazel-* targets (bazel-check, bazel-test(-remote), bazel-rbe-smoke) and updates ignore files to exclude Bazel output directories.

^{Reviewed by Cursor Bugbot for commit 7b58e5d. Bugbot is set up for automated code reviews on this repo. Configure here.}