fix(agent): make the functional-test report say what it actually tested

[shanmugamr1992]

Follow-up to #3522, from continuing to pull on the same sweep. Two commits, each
fixing a way the functional-test report could mislead the person reading it.

1. Known breaks were reported as PR-caused failures

known_issues.py annotate labelled a matched failure with its diagnosis and fix
link but left status: fail, which the report vocabulary defines as "genuine
failure caused by the PR". Nothing looked wrong while apply_baseline.py
happened to cover for it: it downgrades any failure the cached baseline also
hit, and the baseline was red for the same reason.

That cover disappears exactly when a fix is raised. The baseline gets re-taken on
a stack carrying the fix, goes green, stops matching — so the next sweep reports
the same known break as fail against whichever PRs are under test, with a
link to the fix printed directly underneath.

An entry only ever exists for a break the PR did not cause, so annotate now
downgrades to fail (pre-existing) on match. It deliberately does not read
first_seen_megatron_pr as a culprit: that field records which run first
surfaced the break, usually neither the cause nor even the same repository — the
Bridge break in the registry was first seen on Megatron-LM#5382 and caused by
#5865, merged weeks earlier.

Carrying a fix the integration branch cannot reach. sync_integration.sh
cherry-picks open NeMo-RL fixes onto the branch under test, so those reach later
runs by themselves. A Megatron-Bridge or Megatron-LM fix is checked out inside
the container instead, so it had to be passed as --bridge-ref on every single
submit until it merged; forgetting it produces a confident wrong answer rather
than a missing one. run_suite.sh now asks the registry through a new
pending-fix-ref query, and errors rather than guessing when two fixes are
pending in one repo. This makes --fix-branch load-bearing at record time,
which the triage and fix-delivery skills now say.

2. The report did not say which revisions it ran

The header carried four bare shas, retyped by hand into --meta on every post.
Nothing checked them against the run, so a stale copy-paste read exactly like a
result, and the refs that give a sha its meaning were dropped on the way.

That got worse once runs stopped being uniform. Megatron-Bridge is now either the
sha NeMo-RL pins or a fix branch carried in its place, and those are different
claims about what a green table proves. NeMo-RL is normally a fork branch, so its
sha links nowhere a reader can check. megatron-core main and a PR head are
indistinguishable once written as hex.

The report now builds this from the prep block the run already recorded:

Component	Ref	Commit
megatron-core	#5382 head	eb01b689
Megatron-Bridge	mcore-5382-fix — an override, not the Bridge NeMo-RL pins	2940a635
NeMo-RL	nrlta/integration	86774472

Clone URLs are recorded in prep so those links can be built at all. The
watchdog issue imports the same renderer rather than keeping its own, which had
begun asserting a bare Bridge sha that is no longer necessarily the pin.

Test plan

• test_known_issues.sh — 18 checks, extended with the downgrade, the
  suspect-pass and unmatched-failure cases that must not move, the
  stale-entry case that keeps its fail, and pending-fix-ref on none /
  one / two pending fixes
• test_report_stack.sh — new; 17 checks covering all three Bridge ref
  shapes, the fork link, PR-head vs main, header de-duplication, results
  predating the URL record, --state running, and the watchdog heading
• Remaining four agent test scripts pass unchanged
• run_suite.sh --dry-run picks up mcore-5382-fix from the live registry
• Re-annotating the real PR 5382 L1 results downgrades only topp_topk
• Rendered against the real PR 5382 and watchdog baseline results
• ruff check / ruff format

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.