bazel/deps: Handle transitions in reachability aspect (re-land #5149)

[Copilot]

Re-lands #5149 against current main, resolving conflicts with two features that landed in the interim: exec-cfg-safe exclusion settings and per-edge consumers[].attrs recording.

Conflict resolution

Exclusion settings (_excluded_edges/_excluded_patterns) are now carried through every branch of the split transition — the transition outputs include both the config-matrix flags and _EXCLUDED_EDGES_SETTING/_EXCLUDED_PATTERNS_SETTING. Only the flag settings appear in inputs (exclusions are written, never read from incoming settings). This preserves exec-configuration safety across all analyzed configs.

consumers[].attrs is accumulated in _record_edge as a dict and emitted as a sorted union — same semantics as roots. Correctly unioned across configs in the multiconfig case.

New capability (from #5149)

Split-transition multiconfig analysis with a fixed-at-construction-time flag set:

_envoy_dr = dependency_reachability_rule(
    flags = ["//bazel:wasm_runtime"],
    defines = True,
)
envoy_dependency_reachability = dependency_reachability_macro(_envoy_dr)

envoy_dependency_reachability(
    name = "dep-reachability",
    roots = ["//source/exe:envoy_main_common_with_core_extensions_lib"],
    configs = {
        "default":  {},
        "wasmtime": {"//bazel:wasm_runtime": "wasmtime"},
        "legacy":   {"wasm": "v8"},
    },
)

Output gains a per-repo configs list; all fields merge by union across configs (targets, configs, consumers[].roots, consumers[].attrs) with logical-OR for boolean fields (production, testonly).

The existing dependency_reachability is now dependency_reachability_macro(_dependency_reachability_rule()) — backward-compatible; excluded_edges/excluded_patterns/**kwargs pass through unchanged.

Exported helpers (for unit testing)

• config_validation_error(configs, flags, defines) — validates config matrix against declared flags
• merge_defines(existing, values) — merges --define assignments

New tests

• reachability_config_validation_test.bzl / reachability_merge_defines_test.bzl — unit tests for the two exported helpers
• reachability_test_rules.bzl — constructs a test rule varying //dependency/test:reachability_mode
• reachability_test.sh — multiconfig assertions including consumers[].attrs union correctness

[netlify]

✅ Deploy Preview for nifty-bassi-e26446 ready!

Name	Link
🔨 Latest commit	a3a630b
🔍 Latest deploy log	https://app.netlify.com/projects/nifty-bassi-e26446/deploys/6a8c9d9bad020e00085361b7
😎 Deploy Preview	https://deploy-preview-5152--nifty-bassi-e26446.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.