canary-rollout: decide the triage for a pending pair with an unresolvable source commit in _frontier_state_resilient (#1244 item 14) #1249

Summary

In _frontier_state_resilient's data-gap path (run-history fetch failed, so the pending pairs are reconstructed from tags), a pair whose source commit is unresolvable (empty) is classified PRE_EXISTING on main: _reusable_differs returns 0 when the candidate is empty, so classify_failure 0 unknown 0 yields PRE_EXISTING. The pair is still tracked BLOCKED (fail closed).

Raised in the #1243 review (pure-core refactor, closes #1242), where reviewers disagreed on the right triage:

• CodeAnt: PRE_EXISTING suppresses regression triage.
• cubic: forcing REGRESSION falsely claims the candidate changed the reusable and escalates the expected tag-gap hold to needs-human.
• An intermediate - (indeterminate, like the HOLD_UNKNOWN row) was tried and reverted, because it is a behaviour change outside a pure refactor. feat: implement issue #1242 — canary-rollout: move the pair/ring verdict (per-pair state, tag-gap hold) into the pure gate core #1243 restored main's behaviour and added a test pinning PRE_EXISTING.

Decision needed

What triage should "pair pending, source tag unresolvable, run history unreadable" carry?

1. - (indeterminate), recommended. A tag gap says nothing about whether the reusable changed, and an expected data gap should not read as a regression or a pre-existing failure. Needs a check of how sync-issues and promote --allow-pre-existing treat - versus PRE_EXISTING (they currently rank the same for needs-human).
2. PRE_EXISTING (today). No change.
3. REGRESSION. Fails closed hardest but escalates an expected data gap to a human.

Acceptance criteria

• The chosen triage is implemented in _frontier_state_resilient with a test, in its own PR.
• The feat: implement issue #1242 — canary-rollout: move the pair/ring verdict (per-pair state, tag-gap hold) into the pure gate core #1243 regression test (empty src commit … PRE_EXISTING) is flipped deliberately, not by accident.
• All other end-to-end tests pass unchanged; shellcheck --severity=warning -x clean.

Refs #1244, #1243, #1242.