deb_resolve cache not invalidated by manifest change in Bazel 8.0.0

[dillon-giacoppo]

Raising an issue to track compatibility problems with Bazel 8.0.0.

The following flag defaults have been flipped:

• --incompatible_no_implicit_watch_label (--incompatible_no_implicit_watch_label bazelbuild/bazel#23861; now defaults to true)
• --incompatible_use_plus_in_repo_names (--incompatible_use_plus_in_repo_names bazelbuild/bazel#23127; now defaults to true)

This causes issues in apt/private/deb_resolve.bzl. The lack of rctx.watch means changes to the manifest are not causing cache invalidation. The second breaks the :lock --autofix and printed command.

Proposed fixes in: #145