CI: test broad fix batches once and safely retire source PRs

[brandonpayton]

Why

Kandelo has many independently reviewed fixes that need the same expensive integration tests before they can merge. Testing and merging each source pull request separately wastes build capacity, especially when an Application Binary Interface (ABI) change requires rebuilding the package universe. A broad batch is faster, but only if Kandelo can prove exactly which reviewed commits the batch contains.

Without that proof, a maintainer must manually decide which source pull requests were absorbed and which branches are safe to delete. A mistake could close work that did not land or delete a branch that moved after review. This PR adds machine-checked receipts and conservative cleanup so a tested batch can be the merge unit without losing each source change's review history or commit identity.

What changed

• Add an append-only batch-<PR>.json receipt that maps every reviewed source commit to one commit in the batch.
• Verify the exact source heads, complete commit lists, ABI classification, required validation list, current main base, and branch-protection state.
• Compare rebased commits in two layers. A context-free patch ID recognizes the same change when unrelated nearby lines moved; a clean three-way replay must then produce the exact reviewed batch tree. The second check rejects a matching text edit applied at the wrong location, conflict resolutions, and extra changes.
• Run proposed-batch verification from trusted code on main through a read-only pull_request_target workflow. The workflow checks out the exact candidate commit without storing credentials and rejects candidates from forks.
• After a rebase merge, prove that GitHub replayed every batch commit onto main and produced the expected final tree. Rebase merge preserves the individual commits instead of replacing them with one squash commit.
• Add a maintainer-only finalizer that starts in dry-run mode, closes only proven absorbed source PRs, deletes a branch only when it still points to the reviewed commit, and can safely resume after a partial failure.
• Route the new files through Kandelo's existing package-publication and continuous-integration control checks.
• Make the wrong-base regression fixture deterministic so it always exercises the intended non-linear commit-sequence rejection, regardless of commit timestamps.
• Capture successful verifier output before searching it in tests. This avoids an Ubuntu pipefail failure where grep -q exited early and the still-running verifier wrote its remaining plan line into a closed pipe.

Bootstrap boundary

This PR defines the trusted verifier that future batches will use. It must therefore merge on its own: asking the new verifier to certify the PR that creates that verifier would be circular. After this PR is on main, broad batches can carry the new receipt.

For this bootstrap change, the existing Prepare merge controls, the full package-publication workflow tests, and an independent exact-head review provide the evidence. Human reviewers still decide whether each source PR changes the ABI and which test suites its behavior requires. The automation checks that the receipt records the exact sorted union without omissions or duplicates. Validation IDs document the required treatment; they do not start specialty jobs by themselves.

Validation

• ./scripts/dev-shell.sh bash .github/scripts/test-finalize-integration-batch.sh
• ./scripts/dev-shell.sh bash tests/scripts/package-publish-flow.sh
• git diff --check
• Independent review approved exact head c924bca06339192fcd63628e31c9ca3fecc953c5, tree 24435c43b9afb5cfbdca55f8a9f6af9366f0ffc4, with no findings.
• The reviewer reproduced the real Runner: preserve complete guest output when file writes are short #942 context-rebase case under the declared Git 2.51.2 toolchain: ordinary patch IDs differ, context-free IDs match, and the clean replay tree equals the reviewed batch tree.
• GitHub run 29453644339 reproduced the old Linux broken-pipe failure; the production verifier is byte-identical before and after the test-harness correction.

This changes release-control automation only. It does not change the kernel, runtime behavior, package artifacts, browser/Node.js behavior, or the ABI.

[brandonpayton]

Closing because this builds a permanent batching framework, while Kandelo only needs batch PRs as a temporary merge technique. The individual commits remain the bisectable implementation history, and the batch PR plus its GitHub checks remain the validation record. We will preserve reviewed commits in ordinary integration PRs, run the combined validation once, rebase-merge, then manually close absorbed PRs and delete their branches.