[helly25]

CI now exercises Bazel 7.7.2, 8.8.2, and the repository-pinned version across Linux, macOS, and Windows. Each version runs the existing root and consumer checks with separate report artifacts, so compatibility regressions cannot hide behind a green default-version job.

AG;DR

• Extend the existing OS matrix with Bazel 7.7.2, 8.8.2, and an empty entry that lets Bazelisk read .bazelversion (currently 9.1.1). This avoids duplicating the default version and preserves the pinned release as it changes.
• Set USE_BAZEL_VERSION at job scope. Root tests, managed Windows checks, external consumer workspaces, and Bazel-built report collection all inherit the selected version. Keep direct Bazel commands and both runfiles modes unchanged.
• Configure only native Bazel 7 Windows helper fixtures with --shell_executable pointing at the downloaded Bash. Native sh_binary ignores the rules_shell toolchain and otherwise selects the WSL stub on the runner. Consumer servers receive the same legacy configuration through BAZEL_SH. Keep PATH stripped during root tests and run the standalone bashtest runtime check without a shell override or BAZEL_SH, so automatic framework bootstrapping remains independently tested.
• Give every matrix cell a descriptive job name, separate disk-cache namespace, and unique test-results-OS-bazel-VERSION artifact. The existing final gate includes the whole matrix; PRs still only restore caches while main may save them.
• Correct the execution-platform consumer fixture to use exec_compatible_with on both Bazel 7 and 8. Per-group constraints were introduced in Bazel 9, rather than Bazel 8 as previously documented. The same distinct-platform marker assertion still verifies tool configuration on all versions.
• Add regression checks for the complete version matrix, job-scoped selection, and distinct reports. Document the matrix and bring the diagnostics guide into agreement with the merged report behavior: final-attempt counts, separate intentional failures, and collapsed expected diagnostics.

Local validation: pre-commit run --all-files, git diff --check, and full bazel test //... runs with Bazel 7.7.2, 8.8.2, and pinned 9.1.1 passed. Each version passes 18 applicable macOS targets; the Windows-only runtime target is skipped locally. The full manifest-only suites also passed with Bazel 7 and 8. Execution-platform tools consumers passed with both versions, including their older execution-constraint API and the expected analysis-error checks. After correcting the Bazel 8 fixture, repository-wide pre-commit, the pinned full suite, the Bazel 8 manifest-only suite, and the Bazel 8 tools consumer passed again. Both complete external consumer scripts also passed under Bazel 7 and 8, including JUnit failure, filtering, sharding, fail-fast, and timeout checks. The Windows-driver correction passes repository-wide pre-commit and a fresh pinned full suite.

Current-head validation: all 12 checks in run 40251285064 passed on c3065c85c53a0e6d25e3ed3f7271cdfd439116f5: all nine OS/version cells, documentation, pre-commit, and the final gate. Downloaded all nine artifacts and validated 147 invocation records and 588 XML/log pairs. Every root and consumer invocation records the intended Bazel version (7.7.2, 8.8.2, or pinned 9.1.1), all expected outcomes match, and every artifact successfully renders with the Bazel-built summarizer. Windows 7 build events confirm the helper suites use the downloaded-shell override while the standalone bashtest runtime command succeeds without it.

Dependency: #69 merged as c6df64dcb51b73df3548b485e6c8dd76f9742b4d; post-merge main run 40249175905 passed before this branch started. No open PR dependencies. This is the first part of the next audit step; compiled execution-platform tools, end-to-end coverage, and plain sh_test Windows evaluation remain separate follow-ups. No public rule or runner implementation changes.

The matrix has nine cells. Bazel 7/8 patch versions are explicit and can be updated independently; the default row follows .bazelversion. All attempts and expected-fixture evidence remain in artifacts as before. Remote bytestream collection and Windows ARM64 are outside this change.