fix: pin the gate harness across an incompatible requirement

[Verdenroz]

What changed

• Rewrote the merge-base worktree's soothfast version requirements when cargo update --precise is refused, then retried the pin. Only the requirement string moves, so features, optional and default-features beside it survive.
• Changed sync_harness_versions to return a HarnessSync outcome instead of always Ok(()).
• Marked a run whose reference could not be pinned in the gate banner, in the verdict line, and in .soothfast/triage/harness-mismatch.txt. The verdict line is what the PR comment's tail carries.
• Added --allow-harness-change, which waives comparison regressions on a harness-mismatched run. Checked claims hold HEAD against its own declared numbers and are not waived.
• Stamped the mismatch into the stored reference document, so a reference served from the run cache carries the mark of the run that measured it.
• Added a "When the harness moves under a PR" section to docs/gating.md.

Fixes #194

Why

A --against-ref gate builds the merge-base's bench binary from the merge-base's lockfile. When a pull request bumps soothfast across a caret boundary, cargo update -p soothfast@0.2.0 --precise 0.3.1 is refused by the merge-base's own soothfast = "0.2.0" requirement. The pinning code printed a WARN and carried on, so the reference embedded the old harness while HEAD embedded the new one, and the harness delta was reported as the project's regression. That looked like about +5% callgrind instructions on a 30K-instruction bench, under a red verdict, with the only trace scrolled off the top of the log.

The worktree is a throwaway checkout, so its requirement is not worth respecting when it blocks the pin. Where the pin still cannot land, the run says so rather than deciding quietly. A reference measured with a different instrument is not evidence in either direction, so a quiet pass would be as wrong as the red verdict.

Merge ordering

The docs/gating.md section here inserts immediately before ## Ratchets, which is the same anchor another open branch uses. Both additions stand alone, so whichever lands second keeps both sections. Nothing else in this branch overlaps.

How was this tested

• cargo test -p cargo-soothfast: 215 passed, 1 failed. The failure is invoke::tests::a_plain_directory_in_the_repo_is_not_a_worktree_root, which asserts the workspace root is not a linked worktree. It fails from any linked-worktree checkout and passes from a plain one, on this branch and on master.
• cargo fmt --all -- --check: clean.
• cargo clippy --workspace --all-targets -- -D warnings: clean.
• New unit tests cover the caret-incompatible case on harness_mismatches, cargo's refusal text told apart from a network failure, all three requirement shapes, the path-dependency and non-dependency-table skips, trailing-comment preservation, the waiver conditions, both verdict texts, the run-cache round trip, and the triage note.
• cargo test --workspace and make gate BASE=master were not run. The change touches no measured function in the three bench crates.
• The incompatible-requirement path was not reproduced against a live registry. The proof here is the constructed lockfile and manifest fixtures in the unit tests.

Checklist

• make check passes (fmt, clippy -D warnings, cargo test --workspace)
• make gate BASE=master passes, or any intentional cost change is explained above
• Tests added/updated for new behavior (not required for docs/CI-only changes)
• Public API items have /// doc comments
• No new dependency, or its justification is included above (see Dependency Policy)
• Docs (README.md, docs/, soothfast:bind/soothfast:claim markers) updated if behavior changed

[soothfast-bot]

soothfast gate

gate: measuring merge-base of origin/master in worktree (interleaved rounds)
gate: bench binaries identical (code and data match) — no measurable change possible
gate: gating backend = walltime
gate: build=08f03a noise_floor=0.11% thresholds: instructions +5% ir +5% walltime +10.0% alloc/size +5% polls/wakes +5%
ok    soothfast_sdk::bench_emit_typescript walltime_median_ns 2104630.0 -> 2104630.0 (+0.0%)
ok    soothfast_sdk::bench_emit_typescript allocs 42930 -> 42930 (allowed <= 45076)
ok    soothfast_sdk::bench_emit_typescript alloc_bytes 2938940 -> 2938940 (allowed <= 3085887)
ok    soothfast_sdk::bench_lower walltime_median_ns 1354211.0 -> 1354211.0 (+0.0%)
ok    soothfast_sdk::bench_lower allocs 23907 -> 23907 (allowed <= 25102)
ok    soothfast_sdk::bench_lower alloc_bytes 2064788 -> 2064788 (allowed <= 2168027)
ok    soothfast_sdk::bench_emit_typescript assert complexity: claimed O(n); growth drift x0.99 over sizes [16, 64, 256] (limit x2.5)
ok    soothfast_sdk::bench_lower assert complexity: claimed O(n); growth drift x1.31 over sizes [16, 64, 256] (limit x2.5)
gate: passed (2 item(s))