build: run buildifier from just fmt (#28125)

## Intent

Keep Bazel and Starlark files consistently formatted without requiring
contributors to install or version buildifier themselves.

## Implementation

- Add a SHA-256-pinned, cross-platform DotSlash manifest for buildifier
v8.5.1.
- Run buildifier from the shared `just fmt` and `just fmt-check` driver,
with Windows-safe explicit DotSlash invocation.
- Provision DotSlash in formatting CI and contributor devcontainers, and
document the source-build prerequisite.
- Apply the initial mechanical buildifier formatting baseline.

codex-rs/login/BUILD.bazel

@@ -2,10 +2,10 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "login",
-    crate_name = "codex_login",
     compile_data = [
         "src/assets/error.html",
         "src/assets/success.html",
         "src/assets/success_legacy.html",
     ],
+    crate_name = "codex_login",
 )