ci(staging): rebase-rescue conflicting open PRs onto upstream main

[btli]

Summary

• Every night several open PRs skip composition because a merge of their head conflicts with upstream main even when the branch content is fine — typically PRs partially landed upstream (merged in evolved form, cherry-picked), where the total-diff merge conflicts but a commit-by-commit replay succeeds.
• The composer now gives each conflicting open PR one rescue: rebase its head onto upstream main in a throwaway worktree, retry the merge with the rescued head, and push the rescue back to the PR's fork branch so the PR stays current and the next run composes it on the normal path.

Safety properties

• Reproducible: fixed ring identity + --committer-date-is-author-date make rescued oids byte-identical across reruns, so same-day no-op detection keeps working even when a push-back fails (covered by test).
• Leased push-back: --force-with-lease on the pre-rescue head — a branch a human moved meanwhile keeps its newer work; this run still ships the rescue, the next run rescues from the newer head (covered by test).
• Never blanks a PR: a rescue landing exactly on upstream main (PR fully landed) is not pushed and not composed.
• Scope: open PRs only — extras are frozen pins, and the production ring never rescues (covered by test).
• DCO sign-off trailers survive rebase (message-preserving).

Test Plan

• 5 new offline tests in test_stage.py (rescue success incl. fork-branch refresh, reproducibility/no-op rerun, moved-branch lease, production-ring exclusion, and the existing pure-conflict skip still byte-identical).
• Full composer suite: test_stage.py + test_ring_golden.py + test_push_classify.py — 82 passed (goldens untouched).

Note for local checkouts

When the ring rescues one of your PRs, its branch history is rewritten — git pull --rebase (or git reset --hard origin/<branch>) before continuing local work on that branch.