feat(local): auto-propose registry patches and track the feedback loop

Implement steps 3 + 4 of issue #115 on top of the failure classifier, now
that bincraft v4.4.3 applies registry patches/makevars/configure_args to the
target build (not just dependencies), so a trial patched build is meaningful.

- refactor the classify helpers to expose a pure build_triage_report() and a
  list-returning entry builder; failing-builds-report.R now renders from it
- add local/propose-patches.R (step 3, "propose, do not apply"): emit a
  pre-filled registry.json entry for each classified, safe, unregistered
  failure, validate the candidate set against a temporary merged registry,
  and (only on request) --write it plus a proposals ledger, or --open-issue a
  Forgejo tracking issue; the human gate and validator/trial-build acceptance
  stay, and novel source diffs / unknown signatures are never proposed
- add local/trial-build-patch.R: isolated bincraft build of one package with
  the registry applied (no upload/archive/metadata) as the pre-merge gate
- add local/proposal-tracking.R + local/proposal-tracking-lib.R (step 4):
  signature hit rate, proposed-vs-merged, and retirement candidates, with the
  pure helpers covered by tests
- teach validate-patches.R optional PATCH_DIR/REGISTRY_FILE overrides so a
  candidate registry can be validated without touching the real one
- document the propose/trial-build/tracking workflow in local/patches/README.md

local/trial-build-patch.R

@@ -0,0 +1,65 @@
+#!/usr/bin/env Rscript
+
+# Acceptance gate for a proposed registry patch (issue #115, step 3): build one
+# package in isolation with the current `local/patches` registry applied, and
+# report whether it succeeds. Nothing is uploaded, archived, or written to the
+# metadata DB -- `patchhash` keeps the trial binary out of the real cache.
+#
+# Must run inside a build-env image (the same image the failing platform uses),
+# because it invokes the real compiler toolchain via bincraft.
+#
+# Usage:
+#   Rscript local/trial-build-patch.R <package> [tag]
+#
+# Exit status: 0 if the patched build succeeds, 1 otherwise -- so it can gate a
+# CI step or a manual pre-merge check.
+
+args <- commandArgs(trailingOnly = TRUE)
+if (length(args) < 1L) {
+  stop("usage: Rscript local/trial-build-patch.R <package> [tag]")
+}
+package <- args[[1L]]
+tag <- if (length(args) >= 2L) args[[2L]] else NULL
+
+script_path <- local({
+  a <- commandArgs(trailingOnly = FALSE)
+  f <- sub("^--file=", "", a[grepl("^--file=", a)])
+  if (length(f) == 1L && nzchar(f)) normalizePath(f) else NA_character_
+})
+patches_dir <- file.path(
+  if (is.na(script_path)) "local" else dirname(script_path),
+  "patches"
+)
+
+suppressPackageStartupMessages(library(bincraft, quietly = TRUE))
+
+cat(sprintf(
+  "Trial build: %s%s with registry %s (no upload/archive/metadata)\n",
+  package,
+  if (is.null(tag)) "" else sprintf(" @ %s", tag),
+  patches_dir
+))
+
+ok <- tryCatch(
+  {
+    bincraft::build_binary_package(
+      package,
+      tag_limit = 1L,
+      patches = patches_dir,
+      archive = FALSE,
+      upload = FALSE,
+      store_build_metadata = FALSE
+    )
+    TRUE
+  },
+  error = function(e) {
+    cat(sprintf("Trial build FAILED: %s\n", conditionMessage(e)))
+    FALSE
+  }
+)
+
+if (ok) {
+  cat(sprintf("Trial build OK: %s builds with the proposed patch.\n", package))
+  q(status = 0)
+}
+q(status = 1)