[Spikhalskiy]

Keeps gazelle, rules_shellcheck and rules_bazel_integration_test as dev dependencies and stops shipping the packages that load them:

• The gazelle and gazelle_binary targets move from the root package to //tools/gazelle. Gazelle still runs over the whole repository (bazel run //tools/gazelle).
• .gitattributes marks test/ and tools/gazelle/ as export-ignore, except test/integration/basic, the BCR presubmit module. Both the release archive from release_prep.sh and GitHub's source archives are built with git archive, so neither contains those packages.

With an archive built this way, bazel query '@rules_foreign_cc//...' from a consumer module loads every package, and the consumer's module graph is unchanged. Promoting the dev dependencies instead would not cover the nested scenario workspaces under test/integration/ (e.g. rule_based_toolchain loads @msvc_tools). It would also add gazelle, rules_go and rules_shellcheck to every consumer's resolution.

A new downstream_query integration scenario (via a new EXPECT_QUERY runner assertion) queries @rules_foreign_cc//... from a downstream module against the staged distribution, which covers the root package.

Fixes #1614