[ci-scan] Enforce KBE match-count gate; document native-assert array form (#128842)

## Description

Adds a hard pre-emit gate to Branch A of `ci-failure-scan.md`: before
calling `create_issue`, the agent scans the proposed body for the
literal `<!-- ci-scan-match-count: <N> hits in failure.log -->` marker
that KBE-verification check #7 already requires. If absent or `N == 0`,
do not emit; record `skipped: KBE body missing positive match-count
marker` and stop.

## Motivation

Check #7 in `shared/create-kbe.instructions.md` says the marker is
mandatory, but the scanner has emitted KBEs without it. Two recent
examples that BA cannot match and that sit at `0 / 0 / 0` indefinitely:

- #128544 (closed, never matched)
- #128827 (open, will not match either)

Both have the same JSON shape:
```json
{
  "ErrorMessage": "Assertion failed '(op3Reg != targetReg) || (op1Reg == targetReg)' in 'System.Runtime.Intrinsics.X86.Avx512F:FusedMultiplyAddNegated",
  "ErrorPattern": "",
  ...
}
```

That substring lives in the corerun.exe stdout dump on a JIT assert,
which is not in the set of logs BA indexes for KBE matching. Without the
match-count marker (which check #7 requires the agent to verify against
the actual failure log it has access to), there is no pre-flight check
that the signature is even findable. The body looks plausible and gets
filed; BA never matches it; the scanner re-files it next scan as a
"recurrence".

The gate is small (one paragraph) and references existing rules rather
than introducing new policy. The body of the change also documents the
native-assert case explicitly so the agent stops reaching for
`ErrorPattern` as a fix. Regex vs substring does not change which logs
BA reads; the array form (xunit anchor + assert anchor) is the lever,
and check #7 already prescribes it.

## Out of scope

- Backfilling #128544 / #128827 with a working signature (separate
manual edit or a one-off cleanup PR).
- Changing what logs BA indexes (out of dotnet/runtime's control).

cc @kg

> [!NOTE]
> This PR was authored with assistance from GitHub Copilot CLI.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: kotlarmilos

.github/workflows/ci-failure-scan.md

@@ -301,6 +301,8 @@ No meta / aggregate / outage issues. Every KBE is keyed to a single `(definition
 
 Stable means >= 2 occurrences across >= 2 distinct builds in the ~10-build window, OR a build break that fails all legs of the current build (block-everyone severity that warrants filing on first sight). Multiple legs, retries, or work items of the SAME build (same build id) count as a single occurrence, not two — a one-off failure that appears in only one build is NOT stable; record `skipped: < 2 occurrences and not blocking` and let the next run revisit. Emit one `create_issue` using exactly the shared new-KBE template from `.github/workflows/shared/create-kbe.instructions.md` section `<a id="new-kbe-template"></a>` / `## New-KBE template`, including whichever of `<a id="literal-kbe-template"></a>` / `### KBE issue body - literal substring match`, `<a id="regex-kbe-template"></a>` / `### KBE issue body - regex match`, or `<a id="kbe-array-form"></a>` / `### KBE multi-line array form` fits the signature. Apply both `Known Build Error` and `blocking-clean-ci` labels so the org project auto-add rule picks it up; do NOT try to mutate the project from this workflow. Append to the same-run dedup cache (Step 4.0) after emission.
 
+**Match-count gate.** Reject the emit if the body lacks `<!-- ci-scan-match-count: <N> hits in failure.log -->` with `N >= 1`. Treat an absent marker as `N=0` and record the same skip reason check #7 of the shared instructions uses: `skipped: signature did not match failure.log (N=<count>)`. Rationale, log-source caveats, and native-assert handling live in check #7.
+
 If the shared KBE lookup flow recorded `linked-tracker #<tracker>`, cross-link it as `Tracking: dotnet/runtime#<tracker>` in the KBE body. Test-disable PR is deferred to the next run.
 
 **Branch B — Existing KBE; no test-disable PR; test-disable is welcome (Step 4.7 clean).**