manifest/bazel: customer flag passthrough (--bazel-flag, --bazel-startup-flag, --bazel-maven-repo)

[Simon (simonhj)]

Summary

Adds three repeatable CLI flags to socket manifest bazel so customers
can drive the underlying bazel invocations without forking the
orchestrator: matrix-cell selection, host-side JVM tuning, and
non-conventional Maven hub naming.

Stacks on top of the nested-workspace + Bazel-native extraction PR.
Reviewable independently once that one lands.

The three flags

--bazel-flag=<arg>           appended to every subcommand (cquery,
                             query, mod show_extension,
                             mod dump_repo_mapping) after the
                             orchestrator's own flags. Use for matrix-
                             cell selectors:
                               --bazel-flag=--repo_env=SCALA_VERSION=2.13.18
                               --bazel-flag=--config=ci-scala-2-13
                               --bazel-flag=--platforms=//tools:linux_x86_64

--bazel-startup-flag=<arg>   injected into the startup-flag prefix
                             BEFORE the subcommand, after the
                             orchestrator's startup flags (--bazelrc,
                             --output_user_root, --output_base). Use
                             for host-side knobs:
                               --bazel-startup-flag=--host_jvm_args=-Xmx2g

--bazel-maven-repo=<name>    appended to the candidate Maven hub list.
                             Use on legacy WORKSPACE workspaces whose
                             hubs use non-conventional names that the
                             conventional probe list doesn't cover, or
                             on custom Bzlmod extensions
                             `mod show_extension` doesn't enumerate:
                               --bazel-maven-repo=my_jars
                               --bazel-maven-repo=test_maven (repeatable)

Plumbing

BazelQueryOptions gains extraBazelFlags and
extraBazelStartupFlags; the centralised buildStartupFlags and the
new userBazelFlags helpers thread them through every argv builder
uniformly (probe cquery, metadata cquery in bazel-cquery, query,
mod show_extension, mod dump_repo_mapping). ExtractBazelOptions
gains the matching three fields, defaulted to undefined when no CLI
override was supplied.

Trust model

Flag passthrough is verbatim — Bazel's last-wins precedence handles
conflicts between socket.json defaults (bazelFlags) and CLI
overrides (extraBazelFlags). No allowlist; the user invoking the CLI
can already run bazel directly with these flags. Per-invocation
--output_user_root isolation (from the base PR) prevents a hostile
flag from poisoning shared Bazel state across CLI runs.

Tests

Argv-shape assertions for both extra-flag arrays:

• placement before the subcommand for startup flags;
• placement after the standard subcommand flags for trailing flags;
• last-wins precedence when bazelFlags and extraBazelFlags both
  set the same flag;
• outputUserRoot startup-flag placement vs.
  extraBazelStartupFlags;
• cquery argv-shape including extras;
• extraMavenRepoNames threading through the orchestrator end-to-end
  (probe accepts only my_jars; conventional names return
  not-defined; metadata cquery runs once against @my_jars//...).

220 bazel-module tests pass; project typecheck clean.

Test plan

• CI passes (`pnpm test:unit src/commands/manifest/bazel/`)
• Typecheck passes (`pnpm exec tsgo --noEmit`)