gate: read the policy at the base branch tip when the base predates it

[lywinged]

What this changes

A pull request opened before its repository's .github/maintainers.json landed keeps that older base.sha. The gate reads the policy at pr.base.sha, gets a 404, and since the base is not the bootstrap commit it throws HttpError: Not Found on the pull request's next push. On trace-spec, nine open pull requests have a base with no policy file that is not the bootstrap commit, and trace-spec 454 failed this way until main was merged into it.

On a 404 at pr.base.sha the gate now reads the policy at refs/heads/ plus pr.base.ref, the tip of the base branch, which is reviewed base-branch data too. The ref is qualified so a tag with the branch's name cannot stand in for it. The bootstrap list is used only when that read is a 404 as well and the base is the bootstrap commit. Any other missing policy still fails closed, and an error other than a 404 is not retried. A pull request whose base has the file reads it once, at base.sha, as before.

One behaviour changes on purpose: a pull request whose base is the bootstrap commit now reads the policy from the branch tip once the file exists there, instead of the embedded list. On trace-spec the two are identical today.

Tests

node --test scripts/maintainer-roster.test.mjs: 12 pass, 10 before and 2 added. The added tests check that a base from before the policy file reads the policy at the branch tip and still enforces it (no approval, an outsider's approval, an invalid policy and a non-404 error on the first read all fail, and a base branch other than main is read by its own name), and that the bootstrap list applies only when the branch has no policy either, with a non-404 error at the branch tip still failing closed. The test helper now takes base.ref and can make a read fail at one ref only.

Nine wrong versions of the template each fail at least one behaviour test: the template on main, retrying the branch tip on any error, checking the bootstrap commit before the branch tip, reading the branch tip first, using the bootstrap list on any 404, reading head.ref instead of base.ref, reading the bare branch name, always reading refs/heads/main, and falling back to the bootstrap list on any error at the branch tip. Each also fails the consumer test, since the rendered workflow no longer matches.

The rendered trace-spec script was also run against the live API with a stub that calls it read-only. On trace-spec 457 (base 5991999) the current gate throws HttpError: Not Found and this one reads the policy at main and reports that it is awaiting one approval. On 454, whose base has the file, both read once at base.sha with the same result. On 461, whose base is the bootstrap commit, the current gate uses the embedded list and this one reads main, with the same result.

node scripts/maintainer-roster.mjs validate and actionlint 1.7.12 on the re-rendered workflow are clean.

Rollout

Ten repositories in the roster have gate_enabled. Once this merges, each copy other than this repository's own differs from the template, so the daily audit reports drift for them until each is re-rendered. The trace-spec re-render is ready as a pull request there.