[ci-scan-feedback] harden fixer self-dedup with a non-integrity-gated branch-list backstop

## Triggering signals

- (#131981, MEMBER `kotlarmilos`: *"Duplicate https://github.com/dotnet/runtime/pull/131515."* — a `[ci-fix]` help PR that duplicated the fixer's **own** earlier PR #131515; both live on `ci-fix/131382-...` branches and both link KBE #131382, https://github.com/dotnet/runtime/pull/131981)
- (rubric finding: `list_branches` on `dotnet/runtime` shows two `ci-fix/131382-helix-pythonpath-windowsshell-*` branches, plus `ci-fix/android-x509-...-128890-...` and `ci-fix/reflection-unwrap-tie-128766-...` where the KBE id is **mid-name**, not a prefix — so Step 3's `ci-fix/-` prefix key never matched them)
- (rubric finding: `github` MCP `search_pull_requests`/`search_issues` for `[ci-scan]`/`[ci-fix]` artifacts returns `[Filtered]` under the integrity gate — 71 `[ci-scan]` items filtered this tick — silently emptying the dedup PR map, while `list_branches` returns unfiltered results)

## Proposed edits

- (`.github/workflows/ci-failure-fix.md:166` — add a non-integrity-gated `list_branches` dedup backstop with a position-independent `(^|-)ci-fix/(.*-)?(-|$)` token match; directly closes the gap that let #131981 duplicate #131515)
- (`.github/workflows/ci-failure-fix.md:166` — update dedup check 1 to treat either a PR-map hit or a matching branch as authoritative, even when the PR search is `[Filtered]`)
- (`.github/workflows/ci-failure-fix.md:253,263` — require the numeric KBE id to be the first hyphen-delimited branch token in Steps 5.3/5.4 so the branch-list key is reliable going forward)

## Expected behavior change

On the next fixer run, before opening a `[ci-fix]` PR the agent enumerates repository branches (which the integrity gate does not filter) and skips any KBE that already has a `ci-fix/......` branch, regardless of where the id sits in the name. This prevents the recurring failure mode where an integrity-`[Filtered]` PR search hid the fixer's own prior PR and it opened a duplicate for the same KBE (#131981 vs #131515).

> [!NOTE]
> This PR description was generated by an AI agent (GitHub Copilot).

> Generated by [CI Outer-Loop Failure Scanner — Feedback](https://github.com/dotnet/runtime/actions/runs/33312726322) · opus48 · 541.6 AIC · ⌖ 26.5 AIC · ⊞ 20.6K · [◷](https://github.com/search?q=repo%3Adotnet%2Fruntime+%22gh-aw-workflow-id%3A+ci-failure-scan-feedback%22&type=pullrequests)

---

> [!NOTE]
> This was originally intended as a pull request, but the git push operation failed.
>
> **Original error:** The process '/usr/bin/git' failed with exit code 1
>
> **Workflow Run:** [View run details and download bundle artifact](https://github.com/dotnet/runtime/actions/runs/33312726322)
>
> The bundle file is available in the `agent` artifact in the workflow run linked above.

To create a pull request with the changes:

```sh
# Download the artifact from the workflow run
gh run download 33312726322 -n agent -D /tmp/agent-33312726322

# Fetch the bundle into a temporary ref, then update the local branch
git fetch /tmp/agent-33312726322/aw-ci-scan-feedback-dedup-branchlist.bundle refs/heads/ci-scan-feedback-dedup-branchlist:refs/bundles/create-pr-ci-scan-feedback-dedup-branchlist-ff21e57fce465c60-95c03704
git update-ref refs/heads/ci-scan-feedback-dedup-branchlist-ff21e57fce465c60 refs/bundles/create-pr-ci-scan-feedback-dedup-branchlist-ff21e57fce465c60-95c03704
git checkout ci-scan-feedback-dedup-branchlist-ff21e57fce465c60
# Ensure the working tree matches the updated branch
git reset --hard
# Remove the temporary bundle ref
git update-ref -d refs/bundles/create-pr-ci-scan-feedback-dedup-branchlist-ff21e57fce465c60-95c03704

# Push the branch to origin
git push origin ci-scan-feedback-dedup-branchlist-ff21e57fce465c60

# Create the pull request
gh pr create --title '[ci-scan-feedback] harden fixer self-dedup with a non-integrity-gated branch-list backstop' --base main --head ci-scan-feedback-dedup-branchlist-ff21e57fce465c60 --repo dotnet/runtime
```

Read .github/workflows/ci-failure-fix.md around lines 166, 253, and 263, starting with the existing deduplication checks and branch-list handling. Update the checks so matching ci-fix branches remain authoritative when PR search results are filtered, and require the documented branch-token format. Done means the fixer skips an existing KBE branch even when the PR map is unavailable.

Written by the indexing model from the issue text.