fix(test-impact): started roles, fork PRs, base tooling, all test legs - #2959

What this changes

Three fixes to the test-impact gate (smart CI, layer 2), in three commits:

1. Engine: a role started by another role inherits its spawners.
   __cbm_rss_tree_hold is started only by the __cbm_rss_tree_root role
   handler, never by a test, so every change that reached its handler vetoed
   the whole selection (RUNNER_REACHED). That veto decided 14 of the last 39
   engine answers. A handler that names another role's literal now starts
   that role: the started role is lifted with its starter's spawners. A role
   that is both named by a test and started by another role now selects both
   sets of spawners (before: only the direct ones, an under-selection). The
   role note now carries the call chain, like the main-reach note.
2. selection.py: platform-suite classification and a portable view.
   platform-suites lists the suites whose test file holds SKIP_PLATFORM(
   or an #if/#ifdef on an OS or architecture macro (the two markers
   scripts/check-no-test-skips.sh names), at the base and at HEAD, plus
   suites the runner registers under such a conditional: 80 suites today.
   filter --whole-suites writes the view where those suites run whole.
3. CI wiring.
   • select-tests now runs for fork PRs: (vars.TEST_IMPACT_MODE || 'gate') == 'gate'.
     Fork PRs get no repository variables, so all 24 fork runs in the sample
     skipped the job. No pull_request_target, no new permissions, no secrets.
   • select-tests builds and runs the merge base's engine,
     test-impact-select.sh and selection.py against the PR checkout
     (--repo), so a PR can no longer narrow its own tests by changing the
     selection tooling. This matters more now that fork PRs narrow.
   • The arm64 and macOS test-unix legs and the Windows leg now run the
     selection's portable view (platform-neutral suites as selected, every
     platform-specific suite whole). Linux x86_64 runs the selection as
     before. This reverses the 2026-10-16 x86-only decision (maintainer
     decision, 2026-11-11).

CI scope (please review before merge)

• Workflows and jobs touched: pr.yml (select-tests: condition,
  steps, new portable output; test: new test_selection_portable input)
  and _test.yml (new boolean input test_selection_portable; test-unix
  fetches the selection on every leg when the portable view exists;
  test-windows gains a fetch step). Dry run and release do not pass a
  selection and are unchanged. TSan, MSan, diag, LSan, smoke, package
  wrappers and UI legs are unchanged and still run every test.
• Gating: select-tests stays outside ci-ok (a failure means every
  test runs). The test legs stay gating; what changes is how much of the
  suite list they run on arm64, macOS and Windows.
• Cost: select-tests (ubuntu, ~10-15 job-min: engine build plus
  selection) now also runs on fork PRs. Savings from the portable view are
  small today: in the 10 sampled selections the platform-specific suites
  are 76-94% of each leg's suite time and the selections keep 47-176 of
  ~190 suites, so the modelled saving is a median of 0.2-0.6 minutes per
  non-x86 leg (best case 1.4-7.8). See "Known limits".
• Flake surface: narrowed suite waves change which suites share a
  runner on arm64, macOS and Windows; the selection download is a new step
  on those legs (an artifact download failure fails the leg, as it already
  can on x86). The harness selection path itself is exercised on every leg
  by the existing contract step 2c.
• Transition: until this lands, the merge base has no --repo, so this
  PR's own select-tests fails and every test runs. That is the designed
  fail-open path.
• Off switches: TEST_IMPACT_MODE=shadow (same-repo and Dependabot
  PRs); for fork PRs, change the 'gate' default in pr.yml on main; to
  keep narrowing on x86 only, pass test_selection_portable: false.

Known limits (not changed here)

• With the role veto gone, 4 of 6 replayed merged PRs now hit a second
  RUNNER_REACHED that the role veto had masked: the runner's main reaches
  the memory core through its startup path, and the memory core is
  "reached" because the parse-gap rule cascades. A gap's text is matched
  against the short name of every reached node, so gaps fire on generic
  names (idx, n, index, used; 312 distinct firings in one replay),
  and a file-scope gap seeds its whole file. In the sampled replays it was
  src/foundation/compat_thread.c:109 (__attribute__((used)), fired on
  used), which seeds cbm_mutex_init, called by the memory core. An
  experiment that ignores attribute words only moves the way in
  (main -> tf_setup_cache_sentinel -> ... -> platform.cbm_app_local_dir,
  504-1224 firings). Follow-up (decided): gaps will match only reached
  function, variable and macro names, with no whole-file seeding for a
  file-scope gap, validated by a replay miss audit before it gates.
• Ancestor-bundle pollution (main's own commits in A..HEAD) was not changed:
  all 5 polluted verdicts in the sample came from main commits that changed
  runner inputs (a vendored grammar; the harness and Makefile), which the
  ancestor's coverage map does not know. Keeping run_all there is required.
  Follow-up (decided): cut the coverage producer's latency so the exact
  merge-base bundle exists (it was missing in 51% of the sampled runs).

Proof

• Engine: new test_impact_engine_role_started_by_a_role_selects_its_spawners
  is RED on main (run_all, "the change reaches the test-runner role
  __fx_hold_role, which no test names") and GREEN with the fix; suites
  test_impact_engine (22), test_impact, test_impact_artifact,
  test_impact_runner_filter and runner_isolation (99) pass under ASan+UBSan.
• Real input: replaying merged PR 0d835c5 (M^1..M): main's engine vetoes
  on __cbm_rss_tree_hold; the fixed engine no longer does (it then stops
  at the main-reach veto described under "Known limits").
• Fork PRs: all 7 engine answers in the 40-run sample that would have
  narrowed came from fork runs whose select-tests was skipped; with this
  change they reach the test legs.
• selection.py: the portable-view cases pass with this change and fail on
  main (--whole-suites unknown).
• clang-format (Homebrew LLVM) clean on the touched C hunks; memory-core
  linter passes; shellcheck clean on the touched scripts.