Refactor Mike synchronization for capability retries

[ranade-oss]

Summary

Mike Sync v2 now evaluates upstream capabilities instead of treating patch transplantability as the decision.

• Records explicit outcomes: adopted, adapted, equivalent, superseded, incompatible, deferred, retryable, needs-test-harness, and needs-decision.
• Processes one implementation candidate per branch and retains capability, series, dependency, prerequisite, retry, and history metadata.
• Adds one bounded repair attempt before the existing complete exact-head Baseline gate.
• Keeps high-risk/security-sensitive work state-only and draft for human review.
• Adds fail-closed patch/path/size checks and protects synchronization ledgers and policy files.

Legacy deferred entries

Legacy deferred entries remain closed during scheduled work. The escalated workflow now has a deliberate manual input, reconsider_all_deferred=true, which performs one serial v2 attempt for every legacy deferred entry that has not already received a v2 attempt. The pass pauses at a high-risk draft and does not loop on a new v2 defer.

After this draft PR is merged, run:

1. Actions
2. Synchronize escalated upstream Mike capabilities
3. Run workflow
4. Set reconsider_all_deferred to true

Validation

• npm run check passed end to end.
• All 166 Baseline tests passed.
• actionlint passed all workflows.
• Main remains unchanged; this PR is based on 7f427c4b.