Pin Bazel 9.3.0 and verify fork builds - #1

Pin the repository's default Bazel version to 9.3.0 so local builds, nested integration workspaces, and releases use the same exact release. Keep the existing Bazel 7/8/9 and rolling library compatibility matrices unchanged.

This fork has no PR checks, Actions history, or Buildkite webhook. Add a PR workflow for the existing .bazelci/presubmit.yml build/test and Bzlmod integration targets on Linux x64/arm64, macOS x64/arm64, and Windows. Each job checks out the exact PR head and verifies the Bazel version in both workspaces. The WORKSPACE compatibility matrix remains available for older Bazel releases.

Local verification:

• bazel --version, (cd test/repo && bazel --version), and (cd test/testdata/other_repo && bazel --version) each returned bazel 9.3.0 using the cached binary.
• bazel --batch --install_base=/Users/peter/Library/Caches/bazel/_bazel_peter/install/be0838ddda638e2b0233e34df8f07b84 --output_base=/tmp/rules-java-bazel-9-3-0-config help test exited 0.
• The following command exited 0 and accepted every current repository option:

bazel --batch \
  --install_base=/Users/peter/Library/Caches/bazel/_bazel_peter/install/be0838ddda638e2b0233e34df8f07b84 \
  --output_base=/tmp/rules-java-bazel-9-3-0-config \
  canonicalize-flags --for_command=test -- \
  --incompatible_disallow_empty_glob \
  --java_language_version=8 --java_runtime_version=remotejdk_8 \
  --tool_java_language_version=8 --tool_java_runtime_version=remotejdk_8 \
  --javacopt=-Xlint:-options --cxxopt=-std=c++17 --host_cxxopt=-std=c++17 \
  --nointerface_shared_objects --incompatible_java_info_merge_runtime_module_flags

• ruby -ryaml loaded the workflow and presubmit YAML; Bash syntax checks passed; the workflow's build targets exactly match the existing presubmit target list.
• bash -n test/repo/setup.sh .github/workflows/release_prep.sh and git diff --cached --check passed.
• df -h . showed only 398 MiB free. Full local builds/tests and toolchain extraction are resource-blocked; the commands above are bounded configuration checks, not a successful build/test gate. This library ignores module lockfiles; none are committed or changed.

The complete new current-head CI gate must pass before merge:

bazel build -- //... -//test/java/... \
  @remote_java_tools//:ijar_cc_binary @remote_java_tools//:one_version_cc_bin \
  @remote_java_tools//:proguard @remote_java_tools//:singlejar_cc_bin
bazel test --test_output=errors //test/...
(cd test/repo && bash -e setup.sh) # Windows uses the existing setup.bat
(cd test/repo && bazel build //... //:bin_deploy.jar)
(cd test/repo && bazel test --test_output=errors //:MyTest)

Automerge is disabled because this fork's default branch has no enforced status checks. Merge will be manual against the verified head after all relevant CI and review constraints are satisfied.