feat(local): auto-apply registry patches with a build-env trial-build gate

Close the classifier loop (issue #115, step 3): turn the auto-proposable
candidates into an actual PR, gated by a real trial build in our own build-env
images. Model chosen: autonomous PR, PR-first with a CI trial-build gate,
bounded top-N batch per run.

- propose-patches.R: add --limit N (top candidates by failure volume; the rest
  defer to the next run) and --open-pr, which writes the entries onto the reused
  auto/registry-patch-proposals branch, pushes with REPO_RW_TOKEN, and
  opens/updates one PR via the Forgejo API
- add .crow/auto-apply-patches.yaml (single job) to run --open-pr on a cron
- add local/trial-build-registry.R + .crow/trial-build-registry.yaml: the merge
  gate. Matrixed over the real OS/IMG build-env images, each platform diffs the
  branch registry against main and trial-builds only the entries it adds, in
  reg.devxy.io/rpkgs/build-env-*; green only if every new entry builds. The
  base-registry read fails loud rather than silently building the whole registry
- add pure entry_applies_to_os()/new_registry_packages() helpers + tests
- document the autonomous-PR + gate flow in local/patches/README.md

The repo uses no pull_request triggers, so the gate runs manually/cron against
the branch; wiring it to the PR needs event: pull_request on the forge.

local/proposal-tracking-lib.R

@@ -175,4 +175,37 @@ blocked_summary <- function(report, max_pkgs = 15L) {
   })
 }
 
+# Does a registry entry's `platforms` apply to a build on `os` (e.g.
+# "ubuntu-2604")? Mirrors bincraft's token match: an entry applies if any of its
+# platform tokens is "*", the OS codename, or the distro family ("ubuntu").
+entry_applies_to_os <- function(entry_platforms, os) {
+  toks <- as.character(unlist(entry_platforms))
+  family <- sub("-.*$", "", os) # ubuntu-2604 -> ubuntu
+  any(toks %in% c("*", os, family))
+}
+
+# Registry entries present in `current` but not in `base` (matched on
+# package|platforms|versions), optionally restricted to those that apply to a
+# given `os`. Used by the trial-build gate to build only the entries a PR adds.
+new_registry_packages <- function(current, base, os = NULL) {
+  key <- function(e) {
+    sprintf(
+      "%s|%s|%s",
+      e$package %||% "?",
+      paste(sort(as.character(unlist(e$platforms))), collapse = ","),
+      e$versions %||% "?"
+    )
+  }
+  base_keys <- vapply(base %||% list(), key, character(1L))
+  added <- Filter(function(e) !(key(e) %in% base_keys), current %||% list())
+  if (!is.null(os)) {
+    added <- Filter(function(e) entry_applies_to_os(e$platforms, os), added)
+  }
+  unique(vapply(
+    added,
+    function(e) as.character(e$package %||% ""),
+    character(1L)
+  ))
+}
+
 `%||%` <- function(a, b) if (is.null(a)) b else a