Pinned verification commands keep the CI check that proves them

[czpython]

Building the effective profile from the operator's pinned commands hardcoded ci_check to None on every one, discarding what the profiler detected. The evaluator runs any command that names no check — "A configured command with no CI check name runs locally. Never infer that another check covers it." So a repo pinning its verification in .druks/ship/config.yml ran every command in the sandbox on every evaluation and could never read its own CI, however often it was re-profiled.

VerificationProfile.with_ci_checks pairs each pinned command with the check detected for that same command. Pinning chooses which commands gate a PR; it no longer decides what proves them.

Acceptance criteria

• AC1: A pinned command matching a detected command carries that command's ci_check in the stored effective profile.
  • Verification: test_pinned_command_keeps_the_check_detected_for_it pins ("pytest", "make e2e") against a profile that detected pytest under Backend / tests, and asserts the stored entries.
• AC2: A pinned command with no matching detected command carries ci_check: null.
  • Verification: the same test's make e2e entry, plus test_pinned_verification_replaces_the_detected_one and test_skips_the_agent_and_reapplies_the_pin, which pass unchanged.
• AC3: With no pinned verification, the effective profile is the profiler's own output, unchanged.
  • Verification: test_persists_baseline_and_effective, unchanged.

Closes ENG-825.

🤖 Generated with Claude Code