fix(local): stop proposing per-dependent patches for dependency-cascade failures

The `--open-issue` run proposed 800+ entries, all `rcppparallel-bundled-tbb` on
ubuntu-2604, each pre-filling `RcppParallel/disable-tbb.patch` for an unrelated
package (ACEsimFit, AovBay, ...). Those packages fail only because their
RcppParallel *dependency* does not build there, so bincraft records
RcppParallel's TBB error text against each dependent and they all match the
signature. Applying a RcppParallel source patch to a dependent's source is not
just noise -- it is broken (the diff targets RcppParallel's Makevars.in).

Add an optional `applies_to` field pinning a package-specific fix to the package
it targets. A signature whose fix is a curated per-package source patch
(rcppparallel-bundled-tbb -> RcppParallel) is only ever proposed for that
package; other matching packages are downstream failures reported as "blocked on
<dependency>" and never proposed a bogus entry. Fix the dependency once and the
whole cascade clears.

- gate proposal generation in build_triage_report on applies_to, add blocked_on
- surface blocked groups in the report and proposer instead of a misleading
  "already registered" note
- cover both the dependent-blocked and RcppParallel-itself-proposed cases

local/tests/test-failing-builds-classify.R

@@ -85,3 +85,38 @@ test_that("propose_registry_entry fills a schema-valid entry for a known lever",
   # No template -> no proposal (unclassified path).
   expect_null(propose_registry_entry(classify_error("weird"), "x", "alpine"))
 })
+
+test_that("RcppParallel dependents are blocked, not proposed a per-package patch", {
+  # Hundreds of packages fail on ubuntu-2604 only because their RcppParallel
+  # dependency fails to build, so they carry RcppParallel's TBB error text.
+  failures <- data.frame(
+    name = c("ACEsimFit", "AovBay", "AdaptGauss"),
+    platform = "ubuntu-2604",
+    arch = "amd64",
+    error_text = "Error: USE_TBB=Linux is not supported on this toolchain",
+    stringsAsFactors = FALSE
+  )
+  report <- build_triage_report(failures, registered_pkgs = character(0L))
+  grp <- Filter(function(g) g$signature == "rcppparallel-bundled-tbb", report)[[
+    1L
+  ]]
+  # No bogus per-dependent entries (the patch targets RcppParallel's source).
+  expect_null(grp$proposed_entries)
+  expect_identical(grp$blocked_on, "RcppParallel")
+})
+
+test_that("RcppParallel itself is still proposed when it is the failing package", {
+  failures <- data.frame(
+    name = "RcppParallel",
+    platform = "ubuntu-2604",
+    arch = "amd64",
+    error_text = "Error: USE_TBB=Linux is not supported on this toolchain",
+    stringsAsFactors = FALSE
+  )
+  report <- build_triage_report(failures, registered_pkgs = character(0L))
+  grp <- report[[1L]]
+  expect_identical(grp$signature, "rcppparallel-bundled-tbb")
+  expect_false(is.null(grp$proposed_entries))
+  expect_true("RcppParallel" %in% names(grp$proposed_entries))
+  expect_null(grp$blocked_on) # RcppParallel is the target, not a dependent
+})