Update pub extension lockfile handling and smoke coverage

[SpencerC]

What & why

Independent Pub dependency updates previously changed the same pub_deps.json digest and generated repository specifications in MODULE.bazel.lock, creating avoidable merge conflicts. Mark the Pub extension reproducible so Bazel caches its declarations outside the checked-in lockfile while pub_deps.json continues to pin dependencies.

Replace the host Python directory walk with Bazel filesystem calls that track report contents, directory listings, and .bazelignore. Preserve scan exclusions and directory-symlink handling. Regenerate the lockfiles and document the one-time upgrade command.

Merge current main, preserving its Bazel 9 migration, and adapt the offline regression fixture to Bazel 9.2 and the rules_python runfiles library. Five regression cases cover lockfile stability, strict lockfile mode, upgrade cleanup, discovery changes, exclusions, and recovery from Bazel's directory-deletion bug.

Known limitation: Bazel 9.2 can reject a deleted or renamed scanned directory before rerunning the extension (upstream issue, pending 9.3 backport). The dedicated regression explicitly reproduces that failure and verifies recovery with bazel clean --expunge; it does not treat the upstream bug as fixed. The workaround is documented.

Checklist

• bazel test //flutter/tests:all_tests //docs:update_tests passes (28 tests on Bazel 9.2.0)
• cd e2e/smoke && bazel test //:integration_tests passes (23 targets, including five Pub extension regression cases)
• Ran bazel run //docs:update if any rule/macro API changed — not applicable; no rule/macro API changed, and the docs staleness gate passes
• pre-commit run --all-files (buildifier + prettier) is clean; also ran bazel run @buildifier_prebuilt//:buildifier
• Updated docs/README for user-facing changes (hermeticity and migration guides)