Add ci-failure-fix workflow and three-tier mitigation model

Introduce ci-failure-fix.md, a new agentic workflow that walks Known Build
Errors (KBEs) and attempts real mitigations instead of muting tests:
- confident, validated fix -> draft fix PR
- plausible but unverified/out-of-bounds candidate -> draft help-wanted PR
  with a best-effort diff plus an explicit 'what needs review' analysis and
  owner loop-in
- no producible diff (JIT/GC codegen, security/API, infra) -> single
  loop-in comment as a last resort

Update ci-failure-scan to detection-only and extend ci-failure-scan-feedback
to score the new fixer outcomes (confident fix PRs vs help-wanted PRs tracked
separately; a help-wanted PR closed unmerged is not by itself a quality miss).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Milos Kotlar