fix(bazel): honor --no-keep_going when querying Bzlmod repositories

[q4rk]

Summary

When generate-hashes (or serve) runs with --no-keep_going (the default when --keep_going is not passed), query_all_targets_with() previously swallowed failures in bazel mod subcommands and silently returned an empty Vec::new() of //external:* synthetic Bzlmod repository targets while still exiting 0.

When startingHashes and finalHashes are generated across two revisions and one invocation experiences a transient bazel mod failure (or lockfile/extension evaluation error) while the other succeeds, one hash file contains all //external:<repo> targets and the other contains zero //external:<repo> targets. Because transform_external_input() rewrites every external rule input (@repo//pkg:target -> //external:repo) and DigestBuilder::digest_rule() only hashes dependencies present in the target map (if let Some(dependency_digest) = self.target(input, visited)?), every workspace rule that depends on any external repository receives a different rule digest between startingHashes and finalHashes, causing mass false-positive target invalidation across the workspace.

This PR updates src/bazel.rs to honor !self.keep_going (--no-keep_going) during Bzlmod detection and repository hashing, while preserving the existing partial-graph warning and fallback behavior when --keep_going (-k) is enabled.

Root cause

In src/bazel.rs:

1. is_bzlmod_enabled() ran bazel mod graph and collapsed any non-zero exit status or execution error into false (unwrap_or(false)). If MODULE.bazel was present in the workspace and bazel mod graph failed transiently, query_all_targets_with() and dependency_fingerprint() silently treated the workspace as a legacy non-Bzlmod workspace (Vec::new() Bzlmod repos / mode:legacy fingerprint).
2. query_all_targets_with() called self.query_bzlmod_repos(&mut transform).unwrap_or_else(...), logging [Warn] failed to hash Bzlmod repositories and returning Vec::new() even when self.keep_going was false.
3. query_bzlmod_repos() called self.module_graph_json().unwrap_or_default(), silently dropping inter-module dependency edges (//external:<dep>) on //external:<repo> targets if bazel mod graph --output=json failed.

What changed

• check_bzlmod_enabled(&self) -> Result<bool>:
  • Checks whether MODULE.bazel exists in self.workspace (and Bzlmod is not explicitly disabled via --noenable_bzlmod or --enable_bzlmod=false|0|no).
  • When MODULE.bazel is present and !self.keep_going, a failure in bazel mod graph now returns an Err with the exit status and stderr output instead of silently returning false.
• query_all_targets_with(&self, ...) & query_bzlmod_repos(&self, ...):
  • When !self.keep_going, errors from check_bzlmod_enabled(), self.version(), self.query_bzlmod_repos(), and self.module_graph_json() are propagated as Err so the CLI exits non-zero (allowing callers/CI to detect the failure or retry).
  • When self.keep_going is true (--keep_going / -k), the existing [Warn] diagnostic and Vec::new() / empty-edge fallback behavior is preserved.

Verification

Check	Result
bazel test //src:rust_tests //src:cli_tests	Passed (111 unit tests + CLI tests, including bazel::tests::check_bzlmod_and_query_bzlmod_repos_honor_keep_going)
bazel test //:rust_clippy_check //:rust_format_check	Passed
bazel test //tools/... --enable_bzlmod=true --enable_workspace=false	Passed
make coverage	Passed (src/bazel.rs: 91.68%, overall main-source line coverage: 94.38% >= 90.00% threshold)

[tinder-maxwellelliott]

Thanks!