VS Code's hardcoded Bazel clang-format path can be absent before the toolchain is fetched and depends on Bazel's canonical repository naming. Add `buildscripts/clang_format_vscode.sh` and configure `clang-format.executable` in both `.devcontainer/devcontainer.json` and `.vscode_defaults/linux-virtual-workstation.code-workspace` to use it.

The wrapper queries the pinned v5 toolchain repository on each invocation, fetching it when necessary, then executes clang-format with the editor's arguments. It preserves stdin, stdout, the working directory, and exit status, and rejects malformed query output or an unusable executable. It shows Bazel diagnostics only on query failure because `xaver.clang-format` rejects successful processes that emit stderr; clang-format diagnostics still pass through. Both configurations use the extension-supported `${workspaceRoot}` placeholder. Document editor setup in `bazel/docs/developer_workflow.md`, update the example in `docs/devcontainer/architecture.md`, and add a Bazel test target covering missing toolchains, paths with spaces, argument and stdin forwarding, repository changes, and failure propagation.

Bazel must be on the editor's PATH. The initial invocation may take longer to download the toolchain; subsequent invocations still query Bazel so branch and toolchain changes use the current pin.