fix(ci): a red base must not trap the PR that repairs it

[catomean]

Ported from bitbaum/orangecat#650, composed with what this repo already does.

This sweep already handles part of the problem — but a genuine red base still
hard-blocks, so the PR that repairs the base cannot land and only a human can
break the tie. That is the step the queue exists to remove. (It froze
maonakamoto/aoz-housing outright on 2026-08-07.)

Now the sweep identifies which jobs are red and lets a PR through only if its
own checks pass every one of them. Not a weakening: a PR's checks run on the
merge result (refs/pull/N/merge), so green-on-those-jobs is direct evidence
the post-merge base is better than the pre-merge base.

Still refused: a PR that does not run the failing job, one covering only some of
them, and a base failure whose jobs cannot be identified (falls back to the old
blanket refusal). The existing reporting/retry behaviour is kept intact.

Verified against the real script with a fake gh on PATH — five cases, including
a base with no CI history at all (set -u makes an else-only declaration
fatal there, which is a bug this change explicitly avoids).

🤖 Generated with Claude Code