chore(docker): supply docker compose via Bazel

[mnoah1]

Why?

Host-installed Compose versions can reject flags such as up --wait, breaking local stacks and Docker tests.

What?

• Use rules_docker_compose 0.4.0 and its default Compose 5.5.1 directly from Bazel and test runfiles. Upgrade both through MODULE.bazel.
• Upgrade rules_go to 0.59.0 and Gazelle to 0.53.0; keep Go 1.25.0.
• Make service Dockerfiles work without Buildx. Docker CLI and a reachable daemon remain required.

Test Plan

Build, 134 unit targets, 13 Docker integration/e2e targets, documentation, lint, Gazelle, tidy, and mock checks passed. Verified startup, a demo request reaching landed, and shutdown without Buildx or a host Compose plugin.

Unit checks used isolated Git configuration and pinned helpers. Live GitHub cases skipped without credentials. The shared verifier could not complete coverage/lint checks; repository checks passed.

To try locally:

./tool/bazel run @rules_docker_compose//docker_compose -- version
make local-submitqueue-start
make demo-requests COUNT=1 WATCH=true BURST=true
make local-submitqueue-stop

Revert Plan

Revert this PR to restore host-selected Compose and previous build-rule versions.