fix: keep Castiron budget results valid when main advances (#4012)

## Summary

PR base metadata can lag main, and main can advance while Castiron jobs
queue. Comparing each stage with a different base can reject a valid
evaluation or leave required budget statuses missing.

Pin PR reporting and budget policy to the trusted main checkout and the
source run's head, then publish that captured pair even if main
advances. Reports and statuses identify the evaluated base; publication
still verifies the open PR, target repository/branch, current head, and
source run. Evaluation errors publish failed statuses with a link to the
diagnostic run. Pending evaluations are retained, and older publications
cannot overwrite newer results.

Merge groups still independently verify current main, queue membership,
ancestry, and the combined candidate. Budget limits and required-queue
enforcement are unchanged.

Checked with the 59-test offline Castiron suite (one compiler-contract
test skipped), Ruff, Pyright, mypy, and workflow YAML parsing.