Repair current-main specialized CI baseline so unrelated PRs are not born red #391

Recent narrow PRs inherit many red specialized workflows even when their focused contracts pass. Example exact head #384 is green on candidate smoke, package graph, frozen fetch, copy-mode OCI, polyglot, standalone locked install, durable first-install, R2 E2E, agents, formal review and ores-lint, while portability, several Nix/offline/export lanes, repository hardening, global profiles, process locks and normal CI are red.

Task:

• reproduce every red specialized lane on current main and classify source regression vs stale baseline vs infrastructure/admission failure;
• repair true main regressions instead of waiving them on feature PRs;
• where a baseline is intentional, encode a reviewed exact baseline with new-occurrence detection;
• make status output identify baseline-vs-candidate deltas explicitly;
• add a meta-check that a no-op/current-main candidate does not start with unexplained red required lanes.

Acceptance: a narrow PR can distinguish its own regressions from main debt without disabling specialized checks.