IMHO, the best approach that might make this a little easier down the road is to install bazelisk on the buildbots and add a utils/bazel/.bazelversion file, which then also documents which bazel version we intend to support.
On the presubmit and postsubmit bazel bots I’ve uninstalled the bazel from apt and installed a recent bazelisk.
We already have a utils/bazel/.bazelversion that points to 4.0.0. If we’re ok with losing bazel 4.0.0 coverage then changing .bazelversion to 5.0.0 (or whatever version) should be fine. And that should be testable via the bazel presubmit bots.
If anybody is depending specifically on bazel 4.0.0 to build LLVM, please chime in.