tests/tools/rebase_rebless.py: one-command rebase + re-bless with own-drift verification #3385

Problem

Rebasing a parser/channel PR after a sibling merges is always the same manual procedure, and every agent redid it by hand, taking 20–40 min and about 30K tokens each time:

1. rebase onto origin/main, taking main's golden masters and ruff baseline;
2. regenerate with crucible_check.py --update;
3. check that the drift is only this branch's own new keys;
4. refresh the moved ruff-baseline entries;
5. run fast checks;
6. push --force-with-lease.

Proposal

Add tests/tools/rebase_rebless.py:

• Rebase onto origin/main. Artifact conflicts (golden masters, ruff/audit baselines) resolve to main's side and are then regenerated. Any code conflict stops the run and is listed for a human or agent.
• Re-bless, then verify the golden-master diff against main is limited to the keys the branch declares (flag or auto-detected from the pre-rebase diff). Fail loudly on any other drift.
• Refresh baseline entries for this branch's touched files, then run ruff, format and the relevant fast tests.
• --push does git push --force-with-lease (never plain force). The default is a dry run.

Acceptance

• Documented in CLAUDE.md next to crucible_check.py.
• Tested on a synthetic two-branch scenario.
• A branch with foreign drift is rejected.