fix(ci): enforce versioned applicable merge checks without rewriting historical verdicts

用户直接授权实施 2026-09-09 Actions 审计方案。此项为 CI 门禁改造，不交付产品 Feature。

现状：main ruleset disabled；pr-queue只强制三个harness检查，非required pending不等待。

范围：建立有明确适用性/fork回退的聚合门；从单一政策来源生成GitHub required检查；先影子验证，再启用强制规则；缺失/失败/取消/矩阵一片失败/未知必须拒绝，不使未适用lane恒红。

额外发现：pr-green.ts:147用当前classifyChecks重建所有历史合并。直接扩大REQUIRED_CHECKS会把从未拥有新job的历史PR倒查成违规，doctor --strict进而打红所有PR。必须同时版本化政策，按合并时实际生效版本重建；禁止用“看到新job才套新规则”的启发式，因为缺失的新job会逃逸。

验收：当前PR全部适用检查完成才绿；历史旧政策下合法合并结果不漂移；新政策下删除聚合job必红；fork和paths过滤均有反证；GitHub规则只在影子检查通过后激活，并验证规则与单源没有漂移。

依赖：先完成 #3152 / PR #3156 的去重，避免新验证继续重复占用runner。用户直接交办且当前队列基础设施拥堵，故作为队列外工作显式记录。

First review #3152 and PR #3156 for the deduplication dependency, then inspect pr-green.ts at line 147 and the existing classifyChecks logic. Trace how policy versions, applicable checks, forks, and paths are represented before implementing the shadow validation and ruleset activation flow. Done means current applicable checks gate merges, historical verdicts do not change, invalid or missing aggregate jobs fail, and the GitHub rules match the single policy source.

Written by the indexing model from the issue text.