fix(local): stop proposing per-dependent patches for dependency-cascade failures (#121)

## Problem

The scheduled `--open-issue` run (issue #120) posted **800+** proposed entries, all `rcppparallel-bundled-tbb` on `ubuntu-2604`, each pre-filling `RcppParallel/disable-tbb.patch` for an unrelated package (`ACEsimFit`, `AovBay`, `AdaptGauss`, ...).

Root cause: those packages fail on ubuntu-2604 only because their **RcppParallel dependency** does not build there. bincraft records RcppParallel's TBB error text against each dependent, so every one of them matches the `rcppparallel-bundled-tbb` signature. Proposing a RcppParallel source patch for `ACEsimFit` is not just noise -- it is **broken**: the diff targets RcppParallel's `Makevars.in`, so it cannot apply to a dependent's source.

## Fix

Add an optional `applies_to` field that pins a package-specific fix to the package it targets:

- A signature whose fix is a curated per-package source patch (`rcppparallel-bundled-tbb` -> `RcppParallel`) is only ever proposed **for that package**.
- Other packages matching the signature are downstream failures, reported as **"blocked on `<dependency>`"** and never proposed a bogus entry. Fix the dependency once and the whole cascade clears.

Generic levers (the `tbb-stddef-removed` makevars fix) are unaffected -- they carry no `applies_to`, so they still apply to any matching package.

## Changes

- gate proposal generation in `build_triage_report()` on `applies_to`; add a `blocked_on` field to group records
- surface blocked groups in both `failing-builds-report.R` and `propose-patches.R` instead of the misleading "already registered" note
- document `applies_to` in the signature-table header

## Verification

- New tests: RcppParallel dependents are blocked (no `proposed_entries`, `blocked_on = "RcppParallel"`), while RcppParallel *itself* is still proposed when it is the failing package.
- Reproduced the avalanche end-to-end with a stubbed DB: 5 dependents now report "Blocked on RcppParallel: 5 package(s) fail because RcppParallel does not build" and **zero** candidates are emitted; a genuine `tbb-stddef` proposal in the same run is unaffected.
- Full suite: 84 tests pass; all pre-commit hooks pass.

Refs #120.

Note: the underlying build problem (RcppParallel failing on ubuntu-2604 despite its registry entry) is real and separate -- this PR stops the classifier from spamming broken per-dependent proposals about it.
Reviewed-on: #121

local/failing-builds-classify.R

@@ -15,6 +15,11 @@
 # would require a brand-new source diff for a previously-unseen package stay
 # `auto = FALSE` -> classified, but always routed to human triage, per the
 # issue's guardrail against shipping autonomous novel source diffs.
+# `applies_to` (optional) pins a package-specific fix to the package it targets:
+# a signature whose registry patch belongs to one package (e.g. RcppParallel's
+# disable-tbb patch) is only proposed for that package. Other packages matching
+# the signature are downstream failures blocked on that dependency, not
+# individually patchable, so they are reported but never proposed an entry.
 #
 # Seeded from the existing registry entries and known recurring failures; add
 # a row here as new signatures are confirmed. Order matters: the first match
@@ -45,6 +50,14 @@ build_signatures <- function() {
       tier = "patch",
       confidence = "high",
       auto = TRUE,
+      # The fix is a RcppParallel-specific source patch, so it is only ever
+      # proposed for RcppParallel itself. The hundreds of packages that fail
+      # merely because their RcppParallel *dependency* did not build carry
+      # RcppParallel's error text and match this signature too -- they are
+      # blocked on RcppParallel, not individually patchable (applying this diff
+      # to their source is meaningless). `applies_to` pins the proposal so those
+      # downstream failures are never proposed a bogus per-package entry.
+      applies_to = "RcppParallel",
       fix = "apply the curated RcppParallel/disable-tbb.patch so the bundled TBB build is skipped and the TinyThread backend is used",
       example = "RcppParallel",
       registry = list(
@@ -278,9 +291,23 @@ build_triage_report <- function(
     unregistered <- setdiff(pkgs, registered_pkgs)
     auto_proposable <- isTRUE(sig$auto) && sig$matched
 
+    # A signature whose fix is package-specific (`applies_to`) may only be
+    # proposed for that package. Everything else matching it is a downstream
+    # failure blocked on that package (e.g. RcppParallel dependents carrying
+    # RcppParallel's own error text) -- never propose those a bogus entry.
+    proposable <- unregistered
+    blocked_on <- NULL
+    if (!is.null(sig$applies_to)) {
+      proposable <- intersect(unregistered, sig$applies_to)
+      downstream <- setdiff(pkgs, sig$applies_to)
+      if (length(downstream) > 0L) {
+        blocked_on <- sig$applies_to
+      }
+    }
+
     proposed <- list()
     if (auto_proposable) {
-      for (p in unregistered) {
+      for (p in proposable) {
         proposed[[p]] <- propose_registry_entry_list(
           sig,
           p,
@@ -297,6 +324,8 @@ build_triage_report <- function(
       tier = sig$tier,
       confidence = sig$confidence,
       suggested_fix = sig$fix,
+      applies_to = sig$applies_to,
+      blocked_on = blocked_on,
       fingerprint = names(fp_tab)[[1L]],
       fingerprint_variants = length(fp_tab),
       build_count = nrow(g),