Add route policy baseline gate

[Git-on-my-level]

Summary

• Add a deterministic legacy missing-route baseline for the current backend-main route policy manifest gaps.
• Add a strict route policy baseline gate that fails on newly missing manifest entries, stale baseline keys, and PR baseline growth relative to the target branch.
• Keep the full route policy inventory check report-only while docs explain that new routes need real manifest entries instead of legacy-baseline additions.

Context

PR #8967 added the report-only inventory phase for #8959, but it intentionally left the manifest empty and the issue open. This PR is the next ratchet: it blocks new backend-main route policy gaps without inventing policy for the existing legacy surface.

Refs #8959

Review Notes

• Consulted Oracle because this touches CI policy. Its must-fix recommendation was to prevent baseline creep by comparing PR baseline additions against the base branch; this PR implements that via --base-missing-baseline and the PR workflow fetch step.
• This is metadata/tooling only; no runtime request handling changes.

Verification

• .openapi-venv/bin/python -m pytest tests/unit/test_route_policy_inventory.py -q
• scripts/openapi_runner.sh scripts/route_policy_inventory.py --manifest route_policy_manifest.yaml --enforce-missing-baseline --base-missing-baseline route_policy_legacy_missing_routes.txt
• scripts/openapi_runner.sh scripts/route_policy_inventory.py --manifest route_policy_manifest.yaml --check --report-only --max-problem-lines 5
• Pre-push hook passed, including backend preflight, focused route policy tests, OpenAPI contract check, workflow checks, and black --check.

[cubic-dev-ai]

No issues found across 5 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}