spec-guards: score on the base only what t27c frontier cannot reuse (#8095 step 4a) #8225

Problem

The "Affected specs" step of .github/workflows/spec-guards.yml scores every affected spec twice: once on the head and once on the base revision. The base score is the expensive half, and for a spec whose verdict is already sealed it is redundant. t27c frontier (#8110, merged) can say which base specs a build may take as verified (specs/verified/seal_identity.t27), but CI does not ask it.

Fix

Before the scoring loop, run t27c frontier --list against the BASE revision's specs and seals with this head's test runner. A base spec that frontier does not list as a rebuild is taken as base 0 failing tests without being scored.

• A pull request never vouches for itself: only the base's seals are read.
• 0 is the strictest baseline, so a wrong reuse can only turn the step red, never hide a regression.
• The step summary prints frontier's reused N of M line, so the saving is a number.

The saving grows as seals become v2 (#8116).

Acceptance criteria

• spec-guards.yml runs t27c frontier --list on the base tree and skips scoring base specs it reuses
• the step summary of a PR run shows the frontier: reused N of M line

Boundary

.github/workflows/spec-guards.yml

User Scenarios

• Given a pull request modifies one spec among many sealed specs, when the spec-guards workflow runs, then t27c frontier --list executes against the base revision's seals and the head's test runner, and only specs not listed as reusable are scored on the base revision.
• Given a pull request touches no sealed specs, when the spec-guards workflow runs, then the frontier step reports reused 0 of 0 and no base scoring occurs for any affected spec.
• Given a pull request modifies a spec whose seal is v2 and frontier lists it as reusable, when the spec-guards workflow runs, then that spec's base score is skipped and the step summary includes frontier: reused 1 of 1.

Requirements

FR-001: The spec-guards workflow MUST invoke t27c frontier --list against the base revision's specs and seals using the head revision's test runner before entering the scoring loop.
FR-002: The workflow MUST parse the frontier output to identify which base specs are reusable and skip base scoring for those specs, treating them as having 0 failing tests on base.
FR-003: The workflow MUST emit a summary line frontier: reused N of M where N is the count of reused base specs and M is the total affected base specs evaluated by frontier.
FR-004: The workflow MUST only read seals from the base revision; the head revision's seals MUST NOT be consulted for reuse decisions.
FR-005: A spec not listed by frontier as reusable MUST still be scored on both head and base revisions as before.

Success Criteria

• Running the workflow on a PR that modifies 5 sealed v2 specs where frontier reports reused 4 of 5 results in only 1 base spec being scored; the step summary contains frontier: reused 4 of 5 and the workflow exits with exit 0.
• Running grep -c "frontier: reused" <step-summary-file> on the workflow's step summary output returns 1 (the line appears exactly once) and the workflow exits with exit 0.
• A PR modifying only unsealed specs shows frontier: reused 0 of 0 in the step summary and all affected specs are scored on both revisions; the workflow exits with exit 0.
• The workflow file .github/workflows/spec-guards.yml contains the t27c frontier --list invocation and the reuse logic; grep -c "t27c frontier" .github/workflows/spec-guards.yml returns at least 1.