Dispatch Baseline for connector-authored agent heads

[ranade-oss]

What changed

• adds a scheduled and push-triggered dispatcher that finds trusted open agent/** PRs with no Baseline run for their exact current SHA and dispatches baseline.yml on that branch;
• extends the event-driven merger to securely resolve successful workflow_dispatch runs back to exactly one open same-repository PR and recheck the verified SHA, reviews, threads, and mergeability;
• extends bounded automatic repair to resolve failed dispatched Baselines using the same exact-head rules;
• deduplicates by exact SHA, so a completed, failed, or active Baseline is never repeatedly redispatched for the same head.

Security boundaries

The dispatcher can start Actions runs but cannot write repository contents. Merge and repair do not trust the dispatch event alone: each independently resolves the open PR, requires a trusted same-repository agent/** branch, and requires the current PR SHA to equal the completed run's SHA.

Bootstrap note

This PR repairs the mechanism needed to verify connector-authored PR heads, so it cannot receive its own Baseline through the broken path. It will be bootstrap-merged after static YAML and diff review, then exercised using a fresh validation PR and PR #34.