test(integration): add dual-mode bazel-in-bazel sanity test

[novas0x2a]

Adds a single bazel_integration_test scenario that builds a cmake static
library exactly as docs/src/index.md tells users to — regression coverage on
the basic entry point, to land as a stable baseline before the larger bzlmod
hub-and-spoke rework builds on top of it.

The scenario ships both a MODULE.bazel and a WORKSPACE.bazel, and the inner
build runs in whichever pure mode the outer Bazel uses (detected via
bzlmod_enabled.bzl, passed through runner.sh). So bazel test under
--enable_workspace exercises the WORKSPACE path and --enable_bzlmod exercises
the MODULE.bazel path — the same coverage CI's bzlmod/workspaces lanes give.

To support this:

• Declare the rules_bazel_integration_test harness in both MODULE.bazel and
  the root WORKSPACE.bazel, so the test loads in both modes.
• Add a top-level //:distribution filegroup staging the rfcc source tree into
  the inner workspace's runfiles for its local_path_override.
• Import .bazelrc.deleted_packages (generated by
  @rules_bazel_integration_test//tools:update_deleted_packages) so the outer
  Bazel skips the inner scenario package.
• Pregenerate and commit the inner MODULE.bazel.lock and enforce it with
  --lockfile_mode=error, mirroring parent CI.
• Add REPO.bazel ignoring bazel-* convenience symlinks at the traversal
  level (glob excludes are a post-filter, not a traversal guard, so they'd
  otherwise trip InconsistentFilesystemException under concurrent
  bazel test //...), and gitignore them.