test: reproducer for #401 (undeclared workspace reads get stable hashes)

[tinder-maxwellelliott]

What

Adds an E2E reproducer for #401 — a feature request for "always-affected" hashing of targets that perform undeclared workspace reads (non-hermetic targets).

• New fixture cli/src/test/resources/workspaces/always_affected_external/:
  • //:scanner — a genrule tagged external whose action reads scanned_data.txt but does not declare it as a src (the undeclared / non-hermetic read). Stands in for a buildifier_test that scans every .bzl in the repo without declaring them.
  • //:hermetic — a normal genrule that declares declared_src.txt, for contrast.
• New test testUndeclaredWorkspaceReadIsNotImpacted_reproducerForIssue401 in E2ETest.kt.

Why

bazel-diff derives a target's hash purely from its declared graph (srcs / deps / attributes). A target that reads files it never declares therefore keeps a stable hash even when one of those files changes, so get-impacted-targets skips it — even though the target would behave differently if actually run. This is the gap #401 asks to close.

Behaviour pinned

The test edits both the undeclared read (scanned_data.txt) and the declared src (declared_src.txt) between two checkouts, then asserts the current behaviour:

• //:hermetic is reported as impacted (declared its changed source ✅)
• //:scanner is not reported as impacted (undeclared read → stable hash ❌)

If an --alwaysAffectedTags-style feature later lands, the scanner should start appearing in the impacted set and the final assertion will flag that the behaviour changed.

Notes for reviewers

• Passes locally on Bazel 8.5.1 (~16s).
• Fixture is intentionally minimal — no committed MODULE.bazel.lock (matches the keep_going_repo_failure fixture); Bazel regenerates it in the copied temp workspace.
• Reproducer only; no production code changed.

🤖 Generated with Claude Code