report.json: record the base exit floor beside fail_policy.fail_on #1081

Deferred by the engineering-review implementation loop from #1074 (issue #1024).

Problem

After #1074 the exit code of verify is floored by the base manifest's declared ci.fail_on when --fail-on is absent. The floor is explained only in verifier.json base_notes. A consumer reading report.json alone sees fail_policy.fail_on: [] beside would_fail_ci: true and exit_code: 20 with no stated reason.

Evidence

• src/agents_shipgate/ci/release_decision.py build_release_decision (the exit_fail_on_floor input feeds only exit_code_for_report; fail_policy.fail_on keeps the head's list by design, so the verdict's blocker set is unchanged).
• Reviewer note on fix(verify): read in-repo --diff-from and ci policy from the base #1074 cycle 3.

Proposed fix

Record the effective exit list in the fail_policy block (for example exit_fail_on or exit_fail_on_floor), additive, with a report schema minor bump and the usual STABILITY note, subject to CONTRIBUTING § Surface discipline (the headline metric: a consumer can explain the exit code from report.json alone).

Acceptance criteria

• report.json states the severities that decided the exit code when they differ from fail_policy.fail_on.
• Schema regenerated; STABILITY migration note; existing consumers unaffected.

Source

Engineering review 2026-10-12 follow-up (PR #1074 review cycle 3). Tracked in #1060.