fix(local): stop proposing per-dependent patches for dependency-cascade failures (#121)

## Problem

The scheduled `--open-issue` run (issue #120) posted **800+** proposed entries, all `rcppparallel-bundled-tbb` on `ubuntu-2604`, each pre-filling `RcppParallel/disable-tbb.patch` for an unrelated package (`ACEsimFit`, `AovBay`, `AdaptGauss`, ...).

Root cause: those packages fail on ubuntu-2604 only because their **RcppParallel dependency** does not build there. bincraft records RcppParallel's TBB error text against each dependent, so every one of them matches the `rcppparallel-bundled-tbb` signature. Proposing a RcppParallel source patch for `ACEsimFit` is not just noise -- it is **broken**: the diff targets RcppParallel's `Makevars.in`, so it cannot apply to a dependent's source.

## Fix

Add an optional `applies_to` field that pins a package-specific fix to the package it targets:

- A signature whose fix is a curated per-package source patch (`rcppparallel-bundled-tbb` -> `RcppParallel`) is only ever proposed **for that package**.
- Other packages matching the signature are downstream failures, reported as **"blocked on `<dependency>`"** and never proposed a bogus entry. Fix the dependency once and the whole cascade clears.

Generic levers (the `tbb-stddef-removed` makevars fix) are unaffected -- they carry no `applies_to`, so they still apply to any matching package.

## Changes

- gate proposal generation in `build_triage_report()` on `applies_to`; add a `blocked_on` field to group records
- surface blocked groups in both `failing-builds-report.R` and `propose-patches.R` instead of the misleading "already registered" note
- document `applies_to` in the signature-table header

## Verification

- New tests: RcppParallel dependents are blocked (no `proposed_entries`, `blocked_on = "RcppParallel"`), while RcppParallel *itself* is still proposed when it is the failing package.
- Reproduced the avalanche end-to-end with a stubbed DB: 5 dependents now report "Blocked on RcppParallel: 5 package(s) fail because RcppParallel does not build" and **zero** candidates are emitted; a genuine `tbb-stddef` proposal in the same run is unaffected.
- Full suite: 84 tests pass; all pre-commit hooks pass.

Refs #120.

Note: the underlying build problem (RcppParallel failing on ubuntu-2604 despite its registry entry) is real and separate -- this PR stops the classifier from spamming broken per-dependent proposals about it.
Reviewed-on: #121

local/tests/test-failing-builds-classify.R

@@ -85,3 +85,38 @@ test_that("propose_registry_entry fills a schema-valid entry for a known lever",
   # No template -> no proposal (unclassified path).
   expect_null(propose_registry_entry(classify_error("weird"), "x", "alpine"))
 })
+
+test_that("RcppParallel dependents are blocked, not proposed a per-package patch", {
+  # Hundreds of packages fail on ubuntu-2604 only because their RcppParallel
+  # dependency fails to build, so they carry RcppParallel's TBB error text.
+  failures <- data.frame(
+    name = c("ACEsimFit", "AovBay", "AdaptGauss"),
+    platform = "ubuntu-2604",
+    arch = "amd64",
+    error_text = "Error: USE_TBB=Linux is not supported on this toolchain",
+    stringsAsFactors = FALSE
+  )
+  report <- build_triage_report(failures, registered_pkgs = character(0L))
+  grp <- Filter(function(g) g$signature == "rcppparallel-bundled-tbb", report)[[
+    1L
+  ]]
+  # No bogus per-dependent entries (the patch targets RcppParallel's source).
+  expect_null(grp$proposed_entries)
+  expect_identical(grp$blocked_on, "RcppParallel")
+})
+
+test_that("RcppParallel itself is still proposed when it is the failing package", {
+  failures <- data.frame(
+    name = "RcppParallel",
+    platform = "ubuntu-2604",
+    arch = "amd64",
+    error_text = "Error: USE_TBB=Linux is not supported on this toolchain",
+    stringsAsFactors = FALSE
+  )
+  report <- build_triage_report(failures, registered_pkgs = character(0L))
+  grp <- report[[1L]]
+  expect_identical(grp$signature, "rcppparallel-bundled-tbb")
+  expect_false(is.null(grp$proposed_entries))
+  expect_true("RcppParallel" %in% names(grp$proposed_entries))
+  expect_null(grp$blocked_on) # RcppParallel is the target, not a dependent
+})