bazel/reachability: fix WORKSPACE-mode failure for apparent-name exclusion test fixtures

[Copilot]

The apparent-name exclusion test fixtures (apparent_excluded_repo, apparent_excluded_transitive_repo) were declared only via the bzlmod module extension in MODULE.bazel, so bazel test //dependency/test/... failed under --noenable_bzlmod --enable_workspace with no such package '@@apparent_excluded_repo//'.

• Shared repo declarations: extracted the fixture repo declarations in reachability_test_extension.bzl into a public reachability_test_repos() macro, using the same _test_repo repository rule (already WORKSPACE-compatible). The module extension implementation now just calls this macro.
• WORKSPACE wiring: bazel/WORKSPACE now calls reachability_test_repos() directly, so the fixture repos exist under both bzlmod and WORKSPACE mode without gating any test targets to one mode.
• Test assertion adjustment: one assertion in exclusions_reachability_test.sh hard-coded a check for a bzlmod-mangled canonical repo name. Under WORKSPACE, canonical name equals apparent name, so the apparent-name exclusion test degenerates to a plain exclusion check there — the assertion now verifies the dependency is recorded under its apparent name regardless of mode.
• Lockfile: MODULE.bazel.lock digest updated automatically to reflect the extension implementation change.