ci: reuse validated mutation gates on promotion

[blafourcade]

🎯 What & why

Promotion snapshots were rerunning the full mutation matrix after the identical source SHA had already passed cli / gate on next. The longest shards held promotion for roughly 30 minutes.

🛠️ How it works

• Reuse mutations only for a numeric promote/next-to-main-* PR whose exact SHA passed the cli CI push run and its cli / gate on next.
• Any missing, failed, or unreadable proof retains normal mutation scopes and logs the fallback reason.
• Coverage, smoke, build, platform, and other non-mutation checks still run on the pull request merge ref.

🧪 How to verify

• node --test scripts/__tests__/cli-ci-gate-covers-every-job.test.js
• actionlint .github/workflows/cli-ci.yml
• ./node_modules/.bin/vitest run --project=architecture from cli/
• GitHub Actions API journey: successful cli CI push run and cli / gate found for origin/next SHA.

⚠️ Heads-up

Draft PR. The first promotion after merge still needs the normal GitHub Actions run to validate the repository token permissions.

🔗 Linked issue

None.

✅ I certify

• I DO CERTIFY I READ EACH LINE OF THE PULL REQUEST BECAUSE I AM A SOFTWARE ENGINEER, NOT A AI PUPPY.