fix(ci-speedup): honest data-pass diagnostics for a failed gh probe and a detached tip

TL;DR

Two parts of the speed audit's output told users the wrong thing. When the audit could not reach GitHub (for example inside a sandboxed shell with no network), the summary called the empty result a permanent trait of the repo and the report called the repo archived or inactive. Both blamed login, even though a retry with network access works first try. Separately, an audit run from a checkout pinned exactly at the main branch tip, which is how detached worktrees check out code, warned that the workflow files it read might not match the measured runs, when they were the same commit.

before:  GitHub unreachable  ->  summary: "property of the repo, re-running reproduces it"
                                 report:  "an archived, brand-new, or low-activity repo"
after:   GitHub unreachable  ->  gh's own error + "may be sandboxed / offline; retry with network access"
                                 report:  "Run history was not read ... says nothing about the repo"

before:  checkout pinned at main tip  ->  "workflow YAML source skew" warning
after:   checkout pinned at main tip  ->  no warning (any other detached commit still warns)

What changed

• Failed gh probe. The gh auth status availability probe keeps gh's own error line, skipping the bare host-name line gh prints first. The gh_unavailable reason quotes it and names the sandboxed / no-network cause with its remedy instead of asserting gh is unauthenticated. The API-refused (collection_failed) reason names the same cause, remedy and gh error: a sandboxed shell that can still read gh's stored token lands there.
• Summary. The empty-spine diagnostics no longer print "a PROPERTY of the repo ... re-running reproduces it" when the gh pass never ran. That wording stays for genuine data-shaped empty spines. The required-checks line no longer claims rulesets were "already queried (do NOT re-probe gh)" when gh never ran.
• Report. A gh pass that could not start renders a "Run history was not read" banner and bottom line instead of the dormant-repo banner. Its Data sources row no longer says to pass --repo that was already passed. The footer note no longer ends with a doubled period.
• Detached HEAD at the default tip. _root_branch_skew treats a detached HEAD as skew unless it is exactly origin/<default> (or the local <default> when no remote ref is fetched). A matching .github/workflows tree alone is not enough, because detectors also read local composite actions and package.json. This matches the attached-branch rule, where a main behind origin/main already warns.
• CHANGELOG.md and ARCHITECTURE.md updated.

Tests (red first)

Each new regression test failed on the code before its fix:

• test_diag_gh_pass_that_never_ran_is_not_called_a_property_of_the_repo: the summary contained "PROPERTY of the repo ... re-running reproduces it".
• test_a_failed_gh_probe_names_its_stderr_and_the_sandbox_cause: the reason was the bare "gh CLI not available or not authenticated".
• test_a_real_gh_probe_failure_quotes_the_error_not_the_hostname (uses gh's real failure layout): the reason quoted github.com.
• test_an_api_blocked_probe_names_the_sandbox_cause_and_gh_words: the refused-collection reason had neither.
• test_a_gh_pass_that_never_started_is_not_rendered_as_a_dormant_repo: the report said "an archived, brand-new, or low-activity repo".
• test_gh_pass_that_never_ran_does_not_forbid_re_probing_gh: the summary said "do NOT re-probe gh".
• test_detached_head_at_the_remote_default_tip_is_not_skew, ..._at_the_local_default_tip_...: each returned a DETACHED HEAD skew record.
• test_detached_head_behind_the_tip_still_warns_even_with_identical_workflows: returned no skew.

Controls that pass before and after: test_diag_durable_break_says_property_not_rerun, test_detached_head_off_the_default_tip_still_warns, test_detached_head_with_no_default_ref_to_compare_still_warns, test_detached_head_at_a_stale_local_default_still_warns_when_origin_moved, test_a_missing_gh_binary_says_the_probe_could_not_run. All git-state tests build throwaway repositories under tmp_path.

🤖 Generated with Claude Code