fix(pin): the pv pin called a runner fault a pinning defect — the classifier existed and nothing asked it

[noahgift]

Closes #3215

guard-cargo turned #3212 red with

FAIL  pv-pin  the pin failed to resolve pv (rc=1) — a release cannot be
              decided by a verifier that did not build.

That names a CODE cause for a runner fault. cargo died with
could not parse/generate dep info at: …/deps/regex-<hash>.d /
No such file or directory (os error 2), and the proof it was the host is in
the same job's own log: the next pv row, 39 s later, built the same pv from
the same tree and passed.

The repo already knew the signature. scripts/cargo_classify.sh ships row
C8 — "dep info, and the host had 933G free -> ENV" — with a committed
fixture log_env_dep_info_contention.txt, written so a dep-info death is not
read as ENOSPC and not read as a code defect. The classifier existed, was
self-tested, and the pin never called it. The defect is an unasked rule.

What changes

file	change
pv_bin.sh	captures its own cargo build, classifies a failure, prints the shared ENV block instead of cargo build of aprender-contracts-cli failed
verifier_pin.sh	verifier_pin_pv gains rc=3 = "the build did not reach a verdict on this host". rc=1 was answering two questions that have two different responses
check_verifier_pinning.sh	rows 4/4b/4c report ENV and count the row as UNMEASURED; the summary says so

Not fail-open. Every ENV path still returns non-zero and the job still goes
red — a pin that did not resolve decides nothing, whatever killed it. The only
thing that changes is which cause is named, and so whether the response is
"triage the runner and re-run" or "hunt a pinning defect that is not there".
The ENV summary line is additive: the FAIL line still prints, because one run
can carry both a runner fault and a real pinning defect.

No retry, deliberately. The evidence says one retry would have turned this
job green — which is the argument against it. A retry converts a measurable
runner fault into a slower green, and contention that never reaches a CI
verdict is contention nobody schedules against.

Six rows, and two of them are the plumbing

LIBS / CLASSIFIER / ENV-LOG / CODE-LOG judge pure functions and would
stay green with the pin left entirely unwired — that is exactly how #3207
shipped 26 green rows that recorded nothing. The two PIN-RC rows call
verifier_pin_pv for real, against a throwaway git repo whose pv_bin.sh
reproduces each death, and assert the return code callers switch on.

Mutation-verified — each killed by the row that should kill it:

mutation	result
delete the rc=3 arm	PIN-RC(env) RED, everything else green
drop dep info from the ENV signature	CLASSIFIER + ENV-LOG + PIN-RC(env) RED
widen ENV to match /error/	CLASSIFIER + CODE-LOG + PIN-RC(code) RED

The third is the fail-open direction, and it is caught.

What was ruled out, and what was not

Both host cleaners were checked against the 11:59:16–11:59:35Z window and
neither ran: ci-disk-watch logged 448GB free (trigger below 400GB) at
11:59:37Z; ci-reaper ran at 11:01:25Z and 12:04:26Z. What removed
target/debug/deps/ mid-build is not established — this PR is about the
verdict, not the cause.

Verification

• check_verifier_pinning.sh full run: PASS (rc=0), pv builds and resolves
• check_verifier_pinning.sh --self-test: PASS, 6 new rows
• bashrs lint: 0 errors on all three files
• check_bashrs_gate.sh: PASS, 295 files
• check_shell_lint_ratchet.sh: PASS, baseline does not grow

🤖 Generated with Claude Code

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=3216 head=e9ce194b54b9b02633cbbecc9b95ff74773dfb6f verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.