ci: float the Bazel matrix per LTS series and add a rolling canary

[xnox]

Summary

The matrix pins four Bazel versions, and each was the newest of its series when it was added — 7.6.1 in #108, 8.3.0 in #144, 9.1.0 and 8.6.0 in #298. They have since gone stale: CI tests 9.1.0 and 8.6.0 while 9.2.0 and 8.7.0 are released. Every new Bazel release needs someone to notice and send a bump.

Bazelisk resolves floating identifiers, so the series heads can track releases themselves:

A floating version identifier like 4.x that returns the latest release from the LTS series started by Bazel 4.0.0.

.bcr/presubmit.yml already expresses its matrix this way (bazel: ["7.x", "8.x", "9.x"]), so this makes the two agree.

Verified with bazelisk locally:

9.x      -> bazel 9.2.0
8.x      -> bazel 8.7.0
7.x      -> bazel 7.7.1
rolling  -> bazel 10.0.0-pre.20260811.3

The matrix

Entry	Why
rolling	Bazel 10 canary — advisory, see below
9.x 8.x 7.x	latest release of each LTS series, tracked automatically
9.1.0	what .bazelversion gives contributors locally
8.3.0 7.6.1	oldest release of their series the matrix covers today

The pins stay because the floating entries would otherwise silently drop coverage of older releases. Note that none of them was ever a deliberate minimum — there is no bazel_compatibility in MODULE.bazel — so if you have a stated support floor, these should be set to it and the rest dropped.

rolling cannot block a merge

continue-on-error: ${{ matrix.bazelversion == 'rolling' }}

A cell with continue-on-error counts as a success for anything that needs: the job, so a broken rolling release shows up in the UI without failing test-roundup. It applies to that cell alone, so every supported version still gates as before — a real failure in 9.x fails the roundup exactly as a failure in 9.1.0 does today.

One incidental fix

The docs-test conditions compared version strings relationally:

if: ${{ matrix.bazelversion >= '9.' || matrix.folder != '.' }}

That does not extend to rolling or N.x, and a cell matching neither branch would silently run no tests at all while reporting green. They now match on the series prefix with startsWith, which is well defined for every entry.

(If #382 lands first these two conditions disappear entirely, and this hunk should be dropped in the rebase.)

Test plan

This PR validates itself — the new matrix runs on it. 9.x and the pinned cells gate; rolling is advisory, and whatever it reports here is the first data point on Bazel 10 readiness.

actionlint clean (the pre-existing SC2086 findings in ci.yaml are unchanged).

🤖 Generated with Claude Code