[deps] Upgrade Bazel to 9.2.0 and migrate to Bzlmod

[Trinkle23897]

Description

Upgrade the repository-wide Bazel toolchain from 8.6.0 to 9.2.0 and migrate EnvPool from the removed WORKSPACE dependency model to Bzlmod.

• Keep .bazelversion, Makefile, Docker images, CI, documentation, and clang-tidy discovery on Bazel 9.2.0.
• Replace WORKSPACE with MODULE.bazel, a checked-in module lockfile, Python 3.12/3.13/3.14 toolchains, and isolated normal/Jumanji/MyoSuite pip hubs.
• Move existing pinned native repositories and Boost setup behind Bzlmod extensions without changing environment dependency versions.
• Update Bazel 9 resource flags, runfiles repository mapping, Boost/rules_cc compatibility, ViZDoom paths, and release-wheel runfiles discovery.
• Backport the already-merged Windows rules_foreign_cc fixes for Bazel 9 cc_import and Bzlmod pkg-config repository names.
• Mirror NASM's upstream MSVC static-library link layout; keep MuJoCo plugin initialization out of MSVC's reserved C++ static-initializer section.
• Quote Bzlmod-generated ViZDoom Windows paths, shorten internal pip-hub names, compact digest-identified Windows/universal wheel repositories, and keep one Playground pixel-test label short enough for nested XML assets; preserve all public repository aliases and all existing test behavior.
• Exclude unused upstream MyoSuite training-agent checkpoints from oracle runfiles, avoiding deeply nested Windows paths without changing oracle behavior or shipped environments.
• Stabilize concurrent ViZDoom startup by bounding Linux OpenBLAS fork handlers and precreating its shared runtime directory; the affected coverage test also passed 12 consecutive uncached stress runs.
• Keep version-specific release entry points explicit so bazel test //... does not redundantly rebuild every native extension under three Python transitions.
• Preserve full clang-tidy invalidation whenever .bazelversion changes.
• Build Ubuntu ARM64 tests with Clang 20, matching the compiler embedded in the official ARM64 MuJoCo oracle wheel; retain GCC and its existing ViZDoom workaround for manylinux release builds.
• Prefer the system Ninja toolchain only on Linux ARM64 because the upstream prebuilt ARM64 Ninja requires glibc 2.38 and cannot run in the official glibc 2.28 manylinux image; other platforms retain their original toolchains.
• Keep LZMA x86 SIMD header detection x86-only, scope ViZDoom's GCC-only optimizer flags to GCC, and allow a mean pixel difference of 1.01 only for Linux ARM64 G1 rough-terrain render alignment; all strict state, observation, reward, and other renderer assertions remain unchanged.

Motivation and Context

Bazel 9 removes the legacy WORKSPACE path used by the current build. Landing the toolchain and module-system migration separately establishes a clean base for later Freedoom, libjpeg-turbo, SDL, and OpenCV upgrades.

Types of changes

• Bug fix
• New feature
• New environment
• Breaking change: internal Bazel build setup migrates to Bzlmod
• Documentation
• Example

Implemented Tasks

• Upgrade every Bazel version pin to 9.2.0.
• Replace WORKSPACE with Bzlmod and commit the generated module lock.
• Preserve all supported Python release versions and native dependency pins.
• Repair upstream oracle source resolution using Bazel's repository mapping.
• Validate the same committed source on macOS ARM64, Linux x86_64, Linux ARM64, and real Windows x86_64 hardware.
• Run Python 3.12/3.13/3.14 release-build/install/test matrices on macOS, Linux x86_64, and Windows.
• Run the exact pull-request Linux release matrix in the official x86_64 and aarch64 manylinux_2_28 images.

Checklist

• I have read the CONTRIBUTION guide.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• Existing behavioral tests cover the migration; no configuration-only tests were added.
• All formatting, static, documentation, and spelling checks pass.
• Linux full-target clang-tidy passes.
• All 98 Bazel test targets pass uncached on macOS ARM64, Linux x86_64, Linux ARM64, and Windows x86_64.

Exact-source verification

Source commit: 6ca1d7c5ff03866e7adbebdc1018824f3c71b388. Every validation below checks this exact public GitHub commit and Bazel 9.2.0.

• macOS ARM64: 9 lint checks; 98/98 uncached Bazel test targets; development wheel; Python 3.12/3.13/3.14 release wheels, isolated installation, uv pip check, and complete installed-wheel make release-test for each version; 42 successful stages and a clean final checkout.

  • envpool-1.2.6-cp312-cp312-macosx_11_0_arm64.whl
  • envpool-1.2.6-cp313-cp313-macosx_11_0_arm64.whl
  • envpool-1.2.6-cp314-cp314-macosx_11_0_arm64.whl

• Linux x86_64 devbox: 10 lint checks including full-target clang-tidy; 98/98 uncached Bazel coverage targets; LCOV summary, badge, and HTML coverage site; development wheel; Python 3.12/3.13/3.14 release wheels, isolated installation, uv pip check, and complete installed-wheel make release-test; Qt-absent Procgen checks against all three wheels.

  • envpool-1.2.6-cp312-cp312-manylinux_2_39_x86_64.whl
  • envpool-1.2.6-cp313-cp313-manylinux_2_39_x86_64.whl
  • envpool-1.2.6-cp314-cp314-manylinux_2_39_x86_64.whl

• Linux ARM64 Ubuntu: 98/98 uncached Bazel test targets on a real aarch64 Ubuntu VM, using the workflow's Clang 20 compiler and software EGL setup. Official MuJoCo oracle compiler matching preserves strict dynamics alignment across DMC manipulator, all 28 robotics/Egg variants, and MyoSuite; G1 rough terrain alone uses the scoped 1.01 render threshold.

• Official x86_64 Linux release image: actual quay.io/pypa/manylinux_2_28_x86_64 (AlmaLinux 8.10, glibc 2.28, official GCC toolchain); Python 3.12 wheel build and installation, pip check, full installed-wheel make release-test, Qt package removal, and make PROCGEN_QT_RUNTIME=absent release-test-procgen-qt all pass.

  • envpool-1.2.6-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl

• Official aarch64 Linux release image: actual quay.io/pypa/manylinux_2_28_aarch64 (AlmaLinux 8.10, glibc 2.28, official GCC toolchain); Python 3.12 wheel build and installation, pip check, full installed-wheel make release-test, Qt package removal, and make PROCGEN_QT_RUNTIME=absent release-test-procgen-qt all pass.

  • envpool-1.2.6-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl

• Windows x86_64 hardware: repository cloned directly from public https://github.com/sail-sg/envpool.git; 98/98 uncached Bazel test targets; Python 3.12/3.13/3.14 release wheels, installation, pip check, and complete installed-wheel make release-test for each version; all wheels contain 17 native modules; the machine's original LongPathsEnabled=0 policy is preserved and task-owned drive mappings were cleaned.

  • envpool-1.2.6-cp312-cp312-win_amd64.whl
  • envpool-1.2.6-cp313-cp313-win_amd64.whl
  • envpool-1.2.6-cp314-cp314-win_amd64.whl

Coverage Summary

Scope	Files	Line Coverage	Branch Coverage
Overall	534	90.80% (45628/50253)	55.13% (32611/59151)
Python	244	86.46% (15631/18078)	71.14% (3332/4684)
C/C++	235	93.23% (29997/32175)	53.76% (29279/54467)
Other	55	n/a	n/a

Hosted CI limitation

GitHub Actions cannot currently start hosted jobs because the repository account is billing-locked: "The job was not started because your account is locked due to a billing issue." The complete lint, test, coverage, and release workflows above were therefore reproduced against the final commit on real macOS ARM64, real Windows x86_64, Linux x86_64, Linux ARM64, and both official manylinux_2_28 release images. Restoring the account is still required for GitHub itself to display passing hosted checks.

New Environment Checklist

Not applicable: this PR upgrades Bazel and its build dependency model without adding an environment family.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-25T18:08:34.141389Z	f2a42e1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.