CI: reject raw-handle debt baseline increases relative to PR merge base #7659

Summary

Enforce the raw-handle debt baseline ratchet across pull request boundaries.

Rationale

The Raw-handle debt ratchet step in .github/workflows/test.yml currently runs:

• python3 scripts/raw_handle_debt.py --self-test
• python3 scripts/raw_handle_debt.py

The normal checker path compares the raw-handle count only with scripts/raw_handle_debt_baseline.txt from the pull request checkout. A pull request can add raw-handle reads and increase the committed baseline to match. The current CI step then passes. The guarded scripts/raw_handle_debt.py --update path rejects baseline increases, but CI does not invoke that path.

Required changes

• In the Raw-handle debt ratchet workflow step, read scripts/raw_handle_debt_baseline.txt from the pull request merge base.
• Compare that merge-base baseline with the checked-out baseline.
• Fail CI when the checked-out baseline is greater than the merge-base baseline.
• Allow an unchanged or lower checked-out baseline.
• Retain the existing --self-test invocation.
• Retain the existing current-count check.

Affected areas

• .github/workflows/test.yml
• scripts/raw_handle_debt.py
• scripts/raw_handle_debt_baseline.txt

Acceptance criteria

• A pull request that raises scripts/raw_handle_debt_baseline.txt relative to its merge base fails the Raw-handle debt ratchet step.
• A pull request that leaves the baseline unchanged passes this comparison.
• A pull request that lowers the baseline passes this comparison.
• The workflow continues to run python3 scripts/raw_handle_debt.py --self-test.
• The workflow continues to run the raw-handle debt count check.
• The implementation handles the GitHub Actions checkout state needed to retrieve the merge-base file.

Backlinks

• Reported in PR feat(gc): RuntimeHandle::across_* and a raw-handle debt ratchet #7389: feat(gc): RuntimeHandle::across_* and a raw-handle debt ratchet #7389
• Review thread: feat(gc): RuntimeHandle::across_* and a raw-handle debt ratchet #7389 (comment)
• Requested by: @jdalton