chore(deps): bump actions/setup-python from 3 to 6 - #721

- verdict.jq: if each PR finding of a list check (actionlint,
  golangci-lint, prettier, actions-pinning, npm ls) also occurs on
  base, the failure is pre-existing. Before, a PR that removed one
  actionlint finding got a block (#717, #721).
- golangci-lint: run with --allow-parallel-runners. A non-zero exit
  with no finding is incomplete, not a failure with 0 findings.
- ui-npm-ci: take the conflict from npm error lines only. An npm warn
  line named the wrong peer on #729.
- deps.py: a package that already had an install script on base adds
  no new script (esbuild on #779).
- ui-dep-usage: join package names with "and".
- pr-state: for a conflicting PR, do not say that the checks ran on
  the PR merged into main.
- verify.sh: save the baseline profile. --phase generated and
  --phase render use it instead of the default profile.

Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>

- classify.sh: when workflows pin an action at several old refs, record
  each ref that the PR replaces. The old version is the lowest of them.
  Before, #718 compared release-secrets v1.2.0 with itself, and #717
  compared only setup-go v5 with v6.
- actions_analysis.py: compare each replaced ref with the new ref. An
  output or input counts as removed only if an old action.yml declared
  it. release-please-action declares no outputs and sets them at run
  time, which gave a false block on #722.
- actions-coverage.sh: read fields with the unit separator. Tab is IFS
  whitespace, so empty fields collapsed and shifted the runtime into
  the wrong field (#717, #721). Show a missing default as "none".

Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>

New fixtures: #717 safe-to-merge (setup-go from v4 and v5), #718 compares
release-secrets v1.0.1 with v1.2.0, #721 needs-human with the
python-version question, #722 needs-human (not block), and #779 block
with the undisclosed updates and no esbuild question. The #831 fixture
expects the new wording. The impact-review copies drop notes about the
old verifier bugs.

replay.sh supports pr_meta, decisions_exclude, and updates expectations.
run.sh adds 16 unit tests with stub tools: the findings subset rule,
golangci-lint lock contention, npm warn lines, install scripts on base,
pr-disclosure, pr-state wording, classify with mixed refs, and
actions-coverage with a stub gh.

Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>

…old image tags

- actions_analysis: evaluate defaults as github.com does. A GHES
  fallback (github.server_url == 'https://github.com' && X || Y) is X,
  so the setup-python token default is not a change (#721). The
  question names the workflows that use the action.
- license-changes: one item per package family, which says dev-only
  build tools: "Accept MPL-2.0 for lightningcss 1.33.0 and 11
  lightningcss-* package(s) (dev-only build tools)?" (#779).
- verdict.jq: a guard regression or a failing gate already shows that a
  change reaches ldcli, so the missing discriminating proof is not an
  incomplete item (#723, #729, #779).
- release-snapshot: accept a tagged release image. A conflicting PR is
  tested at its old head, and trees from before #629 use
  goreleaser-cross:v1.24.2 instead of a digest (#621).

Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>

New fixtures: #621 (forced x/term update, not grouped, release snapshot
on the old tree) and #737 (x/term named only in the Bugbot summary).
The #723 fixture expects no audit question and full note coverage. The
#779 fixture expects full note coverage, GHSA IDs, and the short license
question. The #721 fixture expects no token default in the question.

run.sh adds 12 unit tests with stub tools: bot text and <details> in
pr-disclosure, forced Go updates, npm audit advisory IDs, note coverage
(partial CHANGELOG, missing tag, release scan past 3 pages), the
license family question, impact proof with a guard regression, and the
govulncheck levels. Each one fails on the code before this change.

Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>

The #721 question named the input default: "Accept the changed input
defaults of actions/setup-python in go.yml (python-version: 3.x → none)?"
A person needs the effect instead.

actions-coverage now finds the step after the action and the runner image.
For a dropped python-version default, it asks: "Accept that pre-commit in
go.yml will use the runner's Python 3.12 instead of the newest 3.x in the
tool cache?" If .python-version exists, the question names that version.
Other changed defaults keep the old question.

Co-authored-by: rniebla <rniebla@launchdarkly.com>