ci: track engine main, retire ENGINE_REF, add bias-history (gitgalaxy#2682)

[squid-protocol]

Corpus half of gitgalaxy#2682. Makes this repo behave like gitgalaxy's tri-comparison system: PR-time verification only measures, a push-to-main job regenerates the published artifacts by itself, and no pin points at the other repo.

What changes

ENGINE_REF	Deleted. verify.yml always checks out engine main. To verify against an unmerged engine PR in CI: gh workflow run verify.yml -f engine_ref=pull/<N>/head — a run parameter, nothing committed, nothing to reset.
.github/workflows/verify.yml	Gate loop counts what it ran and fails on zero; a verifier that exits without printing PASS/FAIL is a broken audit (exit 2), not corpus drift. pipefail set so the verifier's status survives tee.
.github/workflows/bias-history.yml (new)	On push to main (data/ledger/tools/SPEC) and daily 06:17 UTC: all 46 gates against engine main → bias_report.py at full precision → commit docs/bias_* + findings_by_language.md to main if changed → open/update/close one issue "corpus owes a re-bless against engine main" listing the failing languages. dry_run input for a no-push rehearsal. Never touches manifests or the ledger.
docs/GATING.md	"Cross-repo choreography" → "Cross-repo flow (no pins)", with a paragraph on why the old procedure could not close. "Relationship to gitgalaxy's own gates" no longer says the corpus sits outside gitgalaxy CI (it has been inside since #2557).
AGENTS.md rules 4 & 6, rosetta-language-sweep skill Phases 4–5 + checklist, README.md step 5	Engine PR merges first; corpus PR against engine main; shipping regenerated docs is optional because CI does it after merge.

Why a direct commit and not a PR like tri-comparison-history

This repo has no AUTOMATION_PAT and "Allow GitHub Actions to create and approve pull requests" is off, so the workflow token cannot open a PR. A token push never re-triggers workflows, so there is no loop to guard. Same mechanism squid-telemetry uses daily. If you would rather have the PR shape, add the PAT secret and I will mirror tri-comparison-history exactly.

Verified

• verify.yml dispatched on this branch for the full 46-gate sweep, and bias-history.yml dispatched with dry_run=true (links in a comment once they finish).
• Both workflow files parse; the dry run proves the regeneration path end to end without pushing.

Cross-repo

Companion: squid-protocol/gitgalaxy PR "ci: rosetta-audit without pins" (its rosetta-audit now checks out this repo's main). Either side can merge first; neither depends on the other's SHA any more. Nothing owed afterwards.

🤖 Generated with Claude Code

[squid-protocol]

Cross-repo companion: squid-protocol/gitgalaxy#2699 (rosetta-audit now checks out this repo's main, classifies against the PR's base branch). Either can merge first.

Full-sweep dispatch of this branch's verify.yml: https://github.com/squid-protocol/keyword-rosetta/actions/runs/33811136620. bias-history.yml cannot be dispatched until it exists on main (GitHub resolves workflow_dispatch against the default branch), so its dry_run=true rehearsal is the first thing to run after merge.

[squid-protocol]

Full-sweep dispatch of this branch's verify.yml against engine main: run 33811136620 — verified 46 of 46 language folders, n/a audit and bias-mode gate green. The PR's own verify check also passes.