[rulex123]

The daily proto update fails for Envoy v1.40.2 because Envoy removed api/bazel/repository_locations.bzl during its migration to Bazel modules.

Read the root MODULE.bazel.lock at the requested Envoy revision instead. Locate each of the six dependencies' registry source.json descriptors and extract the source tag or commit from its archive URL. This handles both the public Bazel registry and Envoy's pinned custom registry, preserving the existing API_SHAS format and download process. Remove the old Starlark parsing and release-date comments.

Use the root lockfile to match Envoy's resolved dependency graph, including CEL 0.25.1; the standalone API lockfile selects CEL 0.24.0. Envoy's dependency CI regenerates lockfiles and checks that they match the committed files.

Validation:

• Bash syntax and git diff --check passed.
• Ran the complete resolver against Envoy v1.40.2 in a temporary checkout; verified all six dependency revisions and the release/container references.
• Ran the unchanged update-api.sh using the emitted revisions; it downloaded 727 proto files.
• Compiled all downloaded proto files with protoc 3.25.8, matching this project's compiler version.
• Full Maven and Envoy integration tests remain pending CI.

Observed failure: https://github.com/envoyproxy/java-control-plane/actions/runs/40855490255/job/123385334334