ci: fence fat_driver case-table annotations; section git fetch reads up to 3 times (P6) #4936

Re-scoped 2026-10-08 (cop executor): two items. Guard-step timeouts are #4921, not this ticket.

A. Planted fat_driver self-test rows raise live ::error:: annotations

x86-main and every workspace-test shard carried section a: failure, section a: cancelled and external job 'workspace-test': not completed within 12000s as error annotations about a minute in. No section had failed. The lines came from fat_driver.py self-test, whose planted rows print real workflow commands (the table passed 60/60). x86-main runs no external-job wait at all, so its 12000 s line could only come from the table. When the job went red later on another section, the annotation was read as the cause.

• feat(release): nightly assets rehearsal — build every release asset on a schedule, unable to upload (#4806) #4813 head 6bf78ea, run 37784220425, job 113337037463: the annotation came 66 s in, and no workspace-test check run exists on that head.
• feat(embed): APR-EMBED-001 EG-0 — probe, M9, verb totality guard, embedding ops, forward contract, corpus #4913 head 964ae94, run 37781580426, job 113325724966: the same annotation, and that head's workspace-test went green.

Fix: the self-test runs inside GitHub's ::stop-commands::<token> fence, through a wrapper (scripts/ci/fence_workflow_commands.sh); fat_driver.py is unchanged. Falsifier: a real self-test failure still turns the step red, with one live ::error:: naming it. A wiring check is RED on an unfenced self-test and on a fenced real run/wait, whose deadline ::error:: must stay live.

B. Section git fetch is one read; a stalled read is a red section

Sections died on RPC failed; curl 92 HTTP/2 stream N was not closed cleanly: CANCEL (err 8) or curl 56 Recv failure: Connection reset by peer, on every runner host alike (the x86-main and shard reds of PRs 4931-4935 and 4923). One tier-step fetch of main at depth 1 ran 376 s and died, although main's objects were already local. The read did not answer; it was not too big. The egress path is with infra.

Change (operator C343 #9, P6): scripts/ci/fetch_p6.sh replaces all 11 git fetch call sites in ci/sections.yml and the merge_group deepen in scripts/lib/resolve_base.sh. This reduces section-fetch drops and does not clear them. actions/checkout already reads 3 times and still failed on #4927. Those drops, and the stalls behind every drop, need infra's network act.

• A read that did not answer is read at most 3 times. An answer (missing ref, not found, 401/403/404) is never re-read.
• Each re-read is one status line.
• Every read is cut when it runs below 1000 B/s for 60 s.
• 3 reads with no answer still fail the step.
• A wiring check is RED on any bare git fetch left in ci/sections.yml.

Checklist

• A: fence the case tables (2e082ae)
• B: P6 fetch helper at every section fetch (d7785ea, 2481ab6); reduces drops, the network act is infra's
• Red/green case tables and mutants in the PR body; the fence confirmed in a real run's log