[FR]: fail the build when a write_source_files target is out-of-date

Currently `write_source_files` relies on a test target to inform developers that a file in bazel-out no longer matches the copy in the source tree, and prompting them with a `bazel run` command to perform the copy operation.

This isn't great because developers may be working with an outdated file in their editor, for example a newly added proto field isn't appearing for auto-completion. Only when they know to run tests (or when CI runs tests for them) do they learn of it.

However I believe that https://bazel.build/extending/rules#validation_actions allow us to catch this during `bazel build` instead. This makes it more likely developers find out - for example if they just `bazel run //my:devserver` they can get a build-time error that the schema is outdated.

Locate the write_source_files target and trace how it currently uses a test target to compare bazel-out files with the source tree. Read Bazel's validation_actions documentation first; done means bazel build reports an out-of-date generated file instead of relying on tests and a manual bazel run copy.

Written by the indexing model from the issue text.