refactor: centralize Bazel path handling for docs builds

[AlexanderLanin]

Why

Make path handling consistent across direct invocation, bazel run, and sandboxed Needs builds. Inputs currently arrive as cwd-relative paths, runfiles keys, or execroot paths; handling those differences at each caller makes the extensions and CLI harder to reason about and brittle for generated or external files. Centralizing execution-mode resolution and making each Bazel path contract explicit reduces duplicated logic while keeping sandbox actions hermetic.

What changed

• Centralize workspace, package, output, and input path resolution in DocsCliConfig and use it from the CLI and extensions.
• Pass Bazel-generated file inputs to Needs actions as named environment variables, keeping SPHINX_EXTRA_OPTS for non-path Sphinx overrides.
• Use runfiles keys for runtime consumers and explicit execroot paths for build actions and genrules.
• Add regression coverage for the supported path modes and the score_pytest runfiles bootstrap.

The TEMPORARY DIFF NOTE comments in the Starlark files are intentionally included in this draft to make the broad migration easier to review; they can be removed before marking the PR ready.

[github-actions]

Documentation preview for this pull request is available at:
pr-834: https://eclipse-score.github.io/docs-as-code/pr-834/