bootstrap: add reusable opt-in consumer setup

[tonyredondo]

Summary

• add reusable Bzlmod and WORKSPACE bootstrap primitives for Go and Python, with --config=test-optimization as the single opt-in for newly bootstrapped setups: omitting the config disables metadata sync and instrumentation, while other companions retain their existing contracts
• make disabled Go instrumentation a structural no-op: when the generated export is disabled, dd_topt_go_test emits the caller-provided raw go_test directly under the public label and creates no hidden raw-test, payload-selector, Bazel-metadata, or Orchestrion targets; enabling the config preserves the existing instrumented orch_go_test path
• preserve the previous always-enabled Go metadata default when enabled_by_env is omitted so upgrades cannot silently enter disabled mode; generated and documented config-gated setups set enabled_by_env = True internally
• fail Go analysis with actionable bootstrap guidance when metadata is enabled but the global Orchestrion setting is disabled, preventing partial upgrades from silently dropping instrumentation
• emit canonical deterministic disabled metadata repositories without credentials, local Git probing, or network access while preserving the public labels and metadata shapes consumed by test rules
• keep unconfigured Orchestrion graph traversal inert: genquery may materialize @rules_go_orchestrion_tool, but the gated repository exposes stable empty public targets and returns before locating Go or building/downloading Orchestrion; adding --config=test-optimization builds and exposes the real tool
• simplify Go and Python onboarding by inferring payload-selection inputs, including Python module_identifier, without per-target configuration; disabled Python keeps the consumer runner and arguments while removing Test Optimization wiring
• integrate Go bootstrap with the existing rules_go Orchestrion flag, including disabled aliases, WORKSPACE fallback repository behavior, and updated pin metadata for the v0.60.0 and v0.61.1 variants
• validate disabled-to-enabled resolution in the same Bazel output root for WORKSPACE and Bzlmod: the disabled phase uses a raw go_test, makes zero metadata HTTP requests, emits no Test Optimization payloads, and exposes only empty Orchestrion repository targets; adding --config=test-optimization then resolves orch_go_test, real aliases, metadata, and payloads without changing the public target
• extend Linux, macOS, and Windows coverage for enabled, omitted-config, explicit-disable, incomplete-activation, generated-workspace cleanup, and same-output-root transition behavior; Windows now exercises the disabled-to-enabled transition as one coherent bootstrap check

Validation

Validation completed during this PR includes:

• ./bazelw test //... --noexperimental_split_xml_generation: 448 tests passed
• focused Go macro/bootstrap validation: 68 tests passed
• focused core validation: 145 tests passed
• Buildifier, ShellCheck, uploader-template lint, and git diff --check passed
• WORKSPACE and Bzlmod Windows-platform smokes passed locally for both enabled and disabled paths with Bazel 8.4.1
• Unix and PowerShell mock-server harnesses passed during the PR
• the Rule checkout was exercised through normal and hermetic local-archive E2E runs in rules_test_optimization_tests for Python wrapper, WORKSPACE Python, WORKSPACE Go monorepo, and Bzlmod Go monorepo
• commit 11a80f2d passes the disabled Orchestrion sentinel matrix for WORKSPACE and Bzlmod on both rules_go v0.60.0 and v0.61.1; each path builds a genquery, directly resolves the empty tool repository, and would fail if real Orchestrion bootstrap were attempted
• the materialized rules_go trees, release archive contents, generated patch profiles, and public denylist checks match for both supported rules_go versions
• a local dd-source validation using Rule overrides passed the Portal genquery regression target, seven representative Go/Python tests, doctor validation, and uploader dry-run with zero upload failures
• published-codeload validation covers the previous Rule head 91f96b44b897cec6694b34dec3d2aa97a8444e97; DataDog/rules_test_optimization_tests#95 is currently pinned to that commit, and will be repinned to 11a80f2d after this head is available through codeload
• GitHub Actions on 11a80f2d is the acceptance gate for the latest repository-gating additions

A full macOS root run without --noexperimental_split_xml_generation encountered Bazel 8.5.1 split-XML generate-xml.sh SIGSEGVs on varying targets. The affected targets passed individually; macOS validation must disable split XML generation until that Bazel issue is resolved.

[datadog-prod-us1-4]

The orch_transition no longer writes @rules_go//go/private/orchestrion:enabled=true; the bool_flag defaults to False. Existing consumers who upgrade the module without re-running the bootstrap tool will silently build orch_go_test targets without Orchestrion instrumentation — tests still pass, so nothing surfaces the regression. All 22 adversarial scenarios (9 Go, 13 Python) passed; no unintended behavioral regressions found elsewhere.

_{📊 Validated against 22 scenarios · Open Bits AI session}

_{🤖 Datadog Autotest · Commit 14d4964 · What is Autotest? · Any feedback? Reach out in #autotest}