build: fix bazel run invocations of js_binary/js_test

After throrough investigation and lots of time spent, I figured out why
the `fs` patch didn't resolve paths within the `.runfiles` directory.

The .runfiles directory of e.g. a js_binary (with bazel run) does have symlinks
for e.g. node_modules/verdaccio point to the execroot directly via an absolute symlink.

This is weird because in other projects there are relative symlinks to
the store (this is important for the sandbox escaping FS patches)), as
otherwise the dereferencing is blocked/prevented and we'd never resolve
into a store directory— preventing transitive deps from being properly
resolved.

After figuring this out, I've tracked down the Bazel issue and found a
fix: bazelbuild/bazel@51d7a3c

In addition, there seems a related `rules_js` issue that has the same
investigation results:
aspect-build/rules_js#1877

We should try this out, but keep an eye on Firefox and Chromium. Those
browser artifacts might contain files with spaces. This is incompatible
with the Bazel version we are using, so the inprocess runfile creation
was a workaround for this— If we remove that flag, we might cause issues
for Mac users.

We have a few options I think:

1. drop the flag, and hope it doesn't break any runfile generation for
  browsers. I suspect it won't work...— alternatively try renaming
  browser files.

2. keep the flag for now, and temporarily keep the disabled FS patches
  (needs to be manually specified by users)

3. do solution (2) but once migration allows it, update to Bazel 7— so
  that the bug with inprocess resolution is nicely fixed.

I think (3) is a good plan moving forward and we don't need any runfile
tricks. In Bazel 8, the runfiles with space issue is also resolved—
allowing us to drop the inprocess runfile creation as well (if we want).

Author: devversion

Diff for: .bazelrc

@@ -4,8 +4,6 @@ build --action_env=NG_FORCE_TTY=false
 # Required by `rules_ts`.
 common --@aspect_rules_ts//ts:skipLibCheck=always
 common --@aspect_rules_ts//ts:default_to_tsc_transpiler
-# TODO: remove this flag once we get to bazel version >7.
-common --incompatible_merge_fixed_and_default_shell_env
 
 # Make TypeScript compilation fast, by keeping a few copies of the compiler
 # running as daemons, and cache SourceFile AST's to reduce parse time.
@@ -156,12 +154,8 @@ build:remote-cache --google_default_credentials
 # Additional flags added when running a "trusted build" with additional access
 build:trusted-build --remote_upload_local_results=true
 
-###############################
-# NodeJS rules settings
-# These settings are required for rules_nodejs
-###############################
-
-# Fixes use of npm paths with spaces such as some within the puppeteer module
+# Fixes issues with browser archives and files with spaces. Could be
+# removed in Bazel 8 when Bazel runfiles supports spaces.
 build --experimental_inprocess_symlink_creation
 
 ####################################################
@@ -172,6 +166,11 @@ build --experimental_inprocess_symlink_creation
 # Prevents the npm package extract from occuring or caching on RBE which overwhelms our quota
 build --modify_execution_info=NpmPackageExtract=+no-remote
 
+# Allow the Bazel server to check directory sources for changes. `rules_js` previously
+# heavily relied on this, but still uses directory "inputs" in some cases.
+# See: https://github.com/aspect-build/rules_js/issues/1408.
+startup --host_jvm_args=-DBAZEL_TRACK_SOURCE_DIRECTORIES=1
+
 ####################################################
 # User bazel configuration
 # NOTE: This needs to be the *last* entry in the config.

Diff for: .bazelversion

@@ -1 +1 @@
-6.5.0
+7.4.0

Diff for: MODULE.bazel

@@ -0,0 +1,5 @@
+# TODO(devversion): Investigate bzlmod and use it where possible.
+
+module(
+    name = "angular_cli",
+)