fix(local): stop proposing per-dependent patches for dependency-cascade failures

The `--open-issue` run proposed 800+ entries, all `rcppparallel-bundled-tbb` on
ubuntu-2604, each pre-filling `RcppParallel/disable-tbb.patch` for an unrelated
package (ACEsimFit, AovBay, ...). Those packages fail only because their
RcppParallel *dependency* does not build there, so bincraft records
RcppParallel's TBB error text against each dependent and they all match the
signature. Applying a RcppParallel source patch to a dependent's source is not
just noise -- it is broken (the diff targets RcppParallel's Makevars.in).

Add an optional `applies_to` field pinning a package-specific fix to the package
it targets. A signature whose fix is a curated per-package source patch
(rcppparallel-bundled-tbb -> RcppParallel) is only ever proposed for that
package; other matching packages are downstream failures reported as "blocked on
<dependency>" and never proposed a bogus entry. Fix the dependency once and the
whole cascade clears.

- gate proposal generation in build_triage_report on applies_to, add blocked_on
- surface blocked groups in the report and proposer instead of a misleading
  "already registered" note
- cover both the dependent-blocked and RcppParallel-itself-proposed cases

local/failing-builds-report.R

@@ -194,6 +194,13 @@ for (r in report) {
       )
       cat(paste0("    ", gsub("\n", "\n    ", j)), "\n", sep = "")
     }
+  } else if (!is.null(r$blocked_on)) {
+    cat(sprintf(
+      "  (blocked on %s -- these %d package(s) fail because that dependency does not build; fix %s, do not patch each dependent)\n",
+      toString(r$blocked_on),
+      length(r$packages),
+      toString(r$blocked_on)
+    ))
   } else if (r$auto_proposable) {
     cat("  (all affected packages already have a registry entry)\n")
   }