Speculative: emit test XML from diff/cmp validate for Bazel 9

[alexeagle]

Summary

This is speculative. It explores what it would take for diff.bzl to emit JUnit XML under Bazel 9 (bazelbuild/bazel#28111), where test runners must write $XML_OUTPUT_FILE themselves.

Scoped to the public API only (diff and cmp with validate=1), not internal build_test targets:

• tools/test/emit-test-xml.sh — shared helper matching Bazel's generate-xml.sh contract
• tools/test/run_with_xml.sh — generic wrapper for future test entrypoints
• diff/private/validate.sh + validate.bzl — shared validation script used by diff and cmp that emits XML when $XML_OUTPUT_FILE is set

build_test is left on @bazel_skylib unchanged.

Caveat: If every test implementation across the ecosystem has to do this individually, that's an awful lot of work. This PR only covers the validate=1 path in the public diff/cmp rules. Note that validation actions are build-time assertions (OutputGroupInfo(_validation=...)), not bazel test actions — so $XML_OUTPUT_FILE is only emitted when that env var is present (e.g. if validations are ever run as test actions). Internal build_test targets will still fail to produce test.xml under figma/8.7.0-figma2.

Test plan

• USE_BAZEL_VERSION=figma/8.7.0-figma2 bazel build //:validate in e2e/smoke — passes
• bazel test //:smoke_test under figma Bazel — expected to fail (build_test doesn't write XML; out of scope)
• //diff/tests:build_test — blocked on macOS by pre-existing GNU diff3 / BSD diff toolchain issue

[alexeagle]

OH I am dumb, the whole point here is validation actions, not tests. no xml