ci: migrate overlay builds and artifact smoke to Buildkite

[longlho]

Move BCR checks, commit hooks, optimized cross-builds and Linux/macOS artifact smoke to Buildkite. Windows GNU artifacts run on the existing Windows queue; MSVC remains on GHA. Linux ARM64 native coverage stays on GHA. Replace yanked libaio .bcr.0 with .bcr.1 in development/consumer harnesses; published overlay entries remain unchanged.

One producer builds distribution assets; smoke jobs verify commit, build, pipeline and SHA-256 before running them. Fork commits require approval except verified Renovate. Bazel caches use the existing pipeline/branch-isolated oss-ci-v2 registry.

Trusted tag builds stage assets on GitHub using short-lived workflow tokens. GHA verifies those assets, runs ARM64 artifact smoke and publishes without rebuilding. Release Please and BCR submission wait for the exact main Buildkite status. Existing release/BCR secrets stay on GHA.

flowchart LR
  Approval[Fork approval] --> BCR[BCR: Bazel 8 and 9]
  Approval --> Hooks[Commit hooks]
  Approval --> Build[Linux: cross-build once]
  Build --> Smoke[Linux and macOS artifact smoke]
  Build --> Windows[Windows GNU artifact smoke]
  Build --> Stage[Trusted tag: stage GitHub assets]
  Stage --> Publish[GHA: verify, ARM64 smoke, publish]
  GHA[Retained GHA] --> Native[ARM64 native coverage]
  GHA --> MSVC[Windows MSVC build and smoke]

Loading

Validation: official Buildkite schema, actionlint, shell syntax, overlay metadata, eight artifact security tests and ten release gate tests passed. Existing OSS queues and GitHub trigger/fork/tag/token settings configured. Automatic PR synchronize triggers verified. Buildkite build 2 passed at edec007316, including both BCR suites and Linux/macOS/Windows artifact smoke. Retained ARM64 GHA passed; MSVC coverage remains enabled. Real tag upload/publishing awaits the next release.