Gate CI on new rustqual findings against the base commit

• Status: Todo
• Kind: Feature
• Authors: jp
• Date: 2026-10-06
• Label: domain=tooling
• Label: type=task

Replace the committed-baseline gate in just qual-ci with qual diff from T-0yh5frr. CI analyses the tree it builds and its base in the same job, and reports only the findings that are new.

Closes T-0yb2pgw: a baseline produced in the same run can't go stale, and it always shares a base with the measured tree.

Base revision

• pull_request: the checkout is refs/pull/N/merge, so the base is HEAD^1, the same parent the changes job already diffs against.
• push to main: the base is github.event.before. On a new branch, where before is all zeros, there's nothing to compare: analyse only, and fail only on enforced rules.
• The qual task's checkout needs enough history to reach the base. fetch-depth: 2 covers pull requests; on push, fetch the before sha explicitly.

Output

• ::error annotations for new findings only, so GitHub's display cap no longer hides the regression behind existing findings.
• The full new-findings table, with guidance, in $GITHUB_STEP_SUMMARY.
• On success, one line: the head and base counts per pass.

Remove

• .config/rustqual/baseline.json, baseline-dry.json and regressions.jq.
• The qual-baseline recipe.
• The canary in qual-ci. The fail-closed behaviour is covered by unit tests in the qual crate.
• Check the justfile, the configs and docs/ for any other references to the baselines. Keep just qual as the exploratory entry point.