fix(bazel): isolate local build and test state

[drew]

Summary

Make Bazel builds and tests reproducible when a checkout already contains Cargo output or the host has system gateway metadata installed.

Related Issue

No issue required: localized build and test-isolation fixes discovered while validating the experimental Bazel workflow.

Related to RFC 0012 (#2543).

Changes

• Track .bazelignore so //... does not traverse Cargo build output
• Isolate OPENSHELL_SYSTEM_GATEWAY_DIR in CLI completer tests
• Update the Bazel setup instructions to reflect the tracked ignore file

Testing

• mise run pre-commit passes
• npx --yes @bazel/bazelisk test //... --test_output=errors --lockfile_mode=error passes (76/76 targets)
• RUST_TEST_THREADS=1 mise run ci passes
• Unit tests updated
• E2E tests not applicable

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable; no architecture change)