feat(local): auto-apply registry patches with a build-env trial-build gate

Close the classifier loop (issue #115, step 3): turn the auto-proposable
candidates into an actual PR, gated by a real trial build in our own build-env
images. Model chosen: autonomous PR, PR-first with a CI trial-build gate,
bounded top-N batch per run.

- propose-patches.R: add --limit N (top candidates by failure volume; the rest
  defer to the next run) and --open-pr, which writes the entries onto the reused
  auto/registry-patch-proposals branch, pushes with REPO_RW_TOKEN, and
  opens/updates one PR via the Forgejo API
- add .crow/auto-apply-patches.yaml (single job) to run --open-pr on a cron
- add local/trial-build-registry.R + .crow/trial-build-registry.yaml: the merge
  gate. Matrixed over the real OS/IMG build-env images, each platform diffs the
  branch registry against main and trial-builds only the entries it adds, in
  reg.devxy.io/rpkgs/build-env-*; green only if every new entry builds. The
  base-registry read fails loud rather than silently building the whole registry
- add pure entry_applies_to_os()/new_registry_packages() helpers + tests
- document the autonomous-PR + gate flow in local/patches/README.md

The repo uses no pull_request triggers, so the gate runs manually/cron against
the branch; wiring it to the PR needs event: pull_request on the forge.

local/tests/test-proposal-tracking-lib.R

@@ -162,6 +162,57 @@ test_that("blocked_summary lists each dependency and its dependent count", {
   expect_true(b[[1L]]$packages_truncated)
 })
 
+test_that("entry_applies_to_os matches codename, family, and wildcard", {
+  expect_true(entry_applies_to_os(list("ubuntu-2604"), "ubuntu-2604"))
+  expect_true(entry_applies_to_os(list("ubuntu"), "ubuntu-2604")) # family
+  expect_true(entry_applies_to_os(list("*"), "ubuntu-2604"))
+  expect_true(entry_applies_to_os(list("alpine", "ubuntu-2604"), "ubuntu-2604"))
+  expect_false(entry_applies_to_os(list("alpine-324"), "ubuntu-2604"))
+  expect_false(entry_applies_to_os(list("ubuntu-2404"), "ubuntu-2604")) # other codename
+})
+
+test_that("new_registry_packages returns only added entries for the platform", {
+  base <- list(
+    list(
+      package = "RcppParallel",
+      platforms = list("alpine", "ubuntu-2604"),
+      versions = "*"
+    )
+  )
+  current <- list(
+    base[[1L]], # unchanged -> not "new"
+    list(package = "BFpack", platforms = list("ubuntu-2604"), versions = "*"),
+    list(
+      package = "someAlpinePkg",
+      platforms = list("alpine-324"),
+      versions = "*"
+    )
+  )
+  # For ubuntu-2604: only the newly-added BFpack (RcppParallel is unchanged,
+  # someAlpinePkg does not apply to this OS).
+  expect_identical(
+    new_registry_packages(current, base, os = "ubuntu-2604"),
+    "BFpack"
+  )
+  # For alpine-324: the alpine package is new and applies.
+  expect_identical(
+    new_registry_packages(current, base, os = "alpine-324"),
+    "someAlpinePkg"
+  )
+  # Without an OS filter, both additions are returned.
+  expect_setequal(
+    new_registry_packages(current, base),
+    c("BFpack", "someAlpinePkg")
+  )
+  # A changed platform set on the same package counts as a new entry.
+  widened <- list(list(
+    package = "RcppParallel",
+    platforms = list("*"),
+    versions = "*"
+  ))
+  expect_identical(new_registry_packages(widened, base), "RcppParallel")
+})
+
 test_that("retirement_candidates flags entries whose package no longer fails", {
   entries <- list(
     list(package = "RcppParallel"),