fix(local): stop proposing per-dependent patches for dependency-cascade failures

The `--open-issue` run proposed 800+ entries, all `rcppparallel-bundled-tbb` on
ubuntu-2604, each pre-filling `RcppParallel/disable-tbb.patch` for an unrelated
package (ACEsimFit, AovBay, ...). Those packages fail only because their
RcppParallel *dependency* does not build there, so bincraft records
RcppParallel's TBB error text against each dependent and they all match the
signature. Applying a RcppParallel source patch to a dependent's source is not
just noise -- it is broken (the diff targets RcppParallel's Makevars.in).

Add an optional `applies_to` field pinning a package-specific fix to the package
it targets. A signature whose fix is a curated per-package source patch
(rcppparallel-bundled-tbb -> RcppParallel) is only ever proposed for that
package; other matching packages are downstream failures reported as "blocked on
<dependency>" and never proposed a bogus entry. Fix the dependency once and the
whole cascade clears.

- gate proposal generation in build_triage_report on applies_to, add blocked_on
- surface blocked groups in the report and proposer instead of a misleading
  "already registered" note
- cover both the dependent-blocked and RcppParallel-itself-proposed cases

local/failing-builds-classify.R

@@ -15,6 +15,11 @@
 # would require a brand-new source diff for a previously-unseen package stay
 # `auto = FALSE` -> classified, but always routed to human triage, per the
 # issue's guardrail against shipping autonomous novel source diffs.
+# `applies_to` (optional) pins a package-specific fix to the package it targets:
+# a signature whose registry patch belongs to one package (e.g. RcppParallel's
+# disable-tbb patch) is only proposed for that package. Other packages matching
+# the signature are downstream failures blocked on that dependency, not
+# individually patchable, so they are reported but never proposed an entry.
 #
 # Seeded from the existing registry entries and known recurring failures; add
 # a row here as new signatures are confirmed. Order matters: the first match
@@ -45,6 +50,14 @@ build_signatures <- function() {
       tier = "patch",
       confidence = "high",
       auto = TRUE,
+      # The fix is a RcppParallel-specific source patch, so it is only ever
+      # proposed for RcppParallel itself. The hundreds of packages that fail
+      # merely because their RcppParallel *dependency* did not build carry
+      # RcppParallel's error text and match this signature too -- they are
+      # blocked on RcppParallel, not individually patchable (applying this diff
+      # to their source is meaningless). `applies_to` pins the proposal so those
+      # downstream failures are never proposed a bogus per-package entry.
+      applies_to = "RcppParallel",
       fix = "apply the curated RcppParallel/disable-tbb.patch so the bundled TBB build is skipped and the TinyThread backend is used",
       example = "RcppParallel",
       registry = list(
@@ -278,9 +291,23 @@ build_triage_report <- function(
     unregistered <- setdiff(pkgs, registered_pkgs)
     auto_proposable <- isTRUE(sig$auto) && sig$matched
 
+    # A signature whose fix is package-specific (`applies_to`) may only be
+    # proposed for that package. Everything else matching it is a downstream
+    # failure blocked on that package (e.g. RcppParallel dependents carrying
+    # RcppParallel's own error text) -- never propose those a bogus entry.
+    proposable <- unregistered
+    blocked_on <- NULL
+    if (!is.null(sig$applies_to)) {
+      proposable <- intersect(unregistered, sig$applies_to)
+      downstream <- setdiff(pkgs, sig$applies_to)
+      if (length(downstream) > 0L) {
+        blocked_on <- sig$applies_to
+      }
+    }
+
     proposed <- list()
     if (auto_proposable) {
-      for (p in unregistered) {
+      for (p in proposable) {
         proposed[[p]] <- propose_registry_entry_list(
           sig,
           p,
@@ -297,6 +324,8 @@ build_triage_report <- function(
       tier = sig$tier,
       confidence = sig$confidence,
       suggested_fix = sig$fix,
+      applies_to = sig$applies_to,
+      blocked_on = blocked_on,
       fingerprint = names(fp_tab)[[1L]],
       fingerprint_variants = length(fp_tab),
       build_count = nrow(g),