feat(pub): declare pub_deps.json reports with pub.from_file

[SpencerC]

What & why

The pub extension finds pub_deps.json files by scanning the root module, and it watches the listing of every directory it reads. On Bazel 9.2, if one of those directories is later deleted, revalidating the extension fails every pub repository with "is no longer an existing directory" (bazelbuild/bazel#30883). The fix (bazelbuild/bazel#31022) ships in 9.3.0, which is still a release candidate. The stale listing lives in the output base's hidden lockfile ($(output_base)/MODULE.bazel.lock), so a server restart does not clear it. Only bazel clean --expunge does.

CI runners that reuse an output base across branches hit this whenever the next branch lacks a directory the previous one had. Re-running on the same runner keeps failing.

This adds pub.from_file(pub_deps = "//app:pub_deps.json"). Declaring any report replaces the scan: the extension reads exactly the declared reports and watches only those files, so adding or deleting directories can neither fail nor rerun it. Without the tag, the scan runs as before.

Adding the tag also recovers a workspace that already hit the error. The changed usages make Bazel rerun the extension instead of revalidating the stale listings (under the default --lockfile_mode=update). test_declaring_reports_recovers_from_deleted_directory_on_bazel_9_2 covers this.

The two MODULE.bazel.lock changes are the flutter extension's bzlTransitiveDigest, which follows extensions.bzl.

Checklist

• bazel test //flutter/tests:all_tests //docs:update_tests passes (28/28 on macOS arm64, Bazel 9.2.0)
• cd e2e/smoke && bazel test //:integration_tests passes (if behavior changed): 24/24 on macOS arm64. //:pub_extension_test runs 7/7 including the two new cases, and both new cases fail if the extension ignores the tag. The first run hit an unrelated flake (a transient git object vanished from the macOS Flutter SDK repository's .git while //flutter_app:lib_format built); a rerun passed.
• Ran bazel run //docs:update (regenerates docs/extensions.md)
• pre-commit run --all-files (buildifier + prettier) is clean: pre-commit is not installed here. I ran the equivalents instead. buildifier --mode=check --lint=warn flutter/extensions.bzl is clean apart from the two existing canonical-repository warnings in _module_root, and prettier 3.1.0 --check passes on README.md and CHANGELOG.md (docs/*.md is prettier-ignored).
• Updated docs/README for user-facing changes (README, docs/migrating.md, docs/hermeticity.md, CHANGELOG)

🤖 Generated with Claude Code