Remove the Kotlin implementation; the Rust CLI is now the only one

[tinder-maxwellelliott]

Summary

The Rust implementation under src/ had been shipping alongside the JVM CLI as //:bazel-diff-rust. This PR removes the Kotlin implementation and everything that existed only to build, test or compare it, and makes the Rust binary //:bazel-diff.

Removed

• cli/ (the Kotlin CLI, its unit tests and JUnit fixtures), proto/ (java_proto), WORKSPACE-mode support (WORKSPACE, repositories.bzl, constants.bzl, artifacts.bzl, maven_install.json, extensions.bzl), the rules_kotlin coverage patch.
• From MODULE.bazel: rules_kotlin, rules_jvm_external + maven, rules_java, rules_proto, stardoc, grpc/grpc-java, rules_nodejs, rules_foreign_cc, the ktfmt extension and the Kotlin toolchain. MODULE.bazel.lock shrinks by ~900 lines.
• The Kotlin-vs-Rust comparison tooling: tools/perf_gate*.py, perf_serve*.py, perf_workload.py, benchmark*.py, serve_stress_compare.py, perf-gate.yaml, docs/kotlin-*.md.

Parity gap closed. explain (#480, issue #479) existed only in Kotlin. It is ported to src/explain.rs with the same flags, text/JSON/DOT/Mermaid output and JSON field names, and 20 unit tests mirroring the Kotlin ones (99.8% line coverage).

Moved / rewired

• E2E fixtures: cli/src/test/resources/ → tests/resources/ (the Rust suite is their only reader); .bazelignore and .gitattributes follow.
• Formatters: //cli/format → //tools/format:rustfmt and //tools/format:buildifier.
• //:bazel-diff → //src:bazel-diff. //:bazel-diff-rust is kept as an alias so existing BCR consumers keep building (BCR presubmit still builds both).
• Coverage checker default include prefixes → src/,tools/coverage/src/,tools/coverage_check.py.
• Serve harnesses, the Alpine stress container, the firecracker bench/guest image and their workflows use the static musl binary instead of the deploy jar.
• Release prep no longer builds or attaches the deploy jar; the release notes drop the WORKSPACE snippet.
• README template, Makefile, tools/e2e split generator (Rust-only now), .claude skills and all workflows updated. README regenerated from the Rust binary's --help.

Verification (local, Bazel 8.7.0, macOS)

• bazel build //... succeeds.
• //:rust_tests //:rust_clippy_check //:rust_format_check //tools/... all pass.
• E2E cases core::integration_golden, core::target_distance_metrics, core::serve_end_to_end pass from the new fixture location.
• Coverage gate passes at 92.81% overall (Go gate 100%).

Not run locally: Bazel 7.x/9.x, Windows, the Alpine/firecracker crons. The CI matrix covers the first two.

Reviewer notes

• CI job names are deliberately stale. Branch protection on master requires test-jre21 (...), test-jre11-run-example (...), Rust candidate ... and release-artifacts (...) by name, so the job ids are kept and only their contents changed (e.g. test-jre21 is now the coverage gate). Rename them together with the branch-protection rule in a follow-up.
• The musl allocator-scalability gate went with the Kotlin baseline it compared against. A Rust-only replacement (musl vs glibc build) is a follow-up.
• integration_external_target.yml runs a script from tinder-maxwellelliott/bazel-diff-repro-1, which may still fetch the deploy jar; that repo needs its own update.
• Cargo.toml is still at 39.0.0 vs 47.0.0 in MODULE.bazel (pre-existing, untouched).

🤖 Generated with Claude Code