[Golden Test] Add golden_verify config block for the collector

[PeterJhongLinksys]

Part of the daily golden-CI triage agent buildout.

Add a project config so collector.py --config <yaml> can override defaults instead of relying on hardcoded constants.

• Create/extend a golden_verify: block (orch_repo, app_repo, workflow_name, pages_base, report_subpath).
• Confirm collector's apply_config() reads it (already implemented; verify wiring end-to-end).

Tracking issue for automation infra (no PrivacyGUI app code changes).

[PeterJhongLinksys]

✅ Dev done. Config ~/.hermes/automation/projects/PrivacyGUI-golden.yaml created with a golden_verify: block (orch_repo / app_repo / workflow_name / pages_base / report_subpath / systemic_fail_fraction). Verified: collector loads it via --config and resolves the real values (app_repo=linksys/PrivacyGUI, verified_branch=dev-2.7.0 read dynamically).

[PeterJhongLinksys]

🔄 Follow-up: the golden_verify block changed after the comment above.

systemic_fail_fraction is no longer 0.05, and it is no longer the only knob. The systemic breaker now requires two conditions to hold together:

systemic_fail_fraction: 0.40   # failing rows / all real rows
systemic_area_fraction: 0.60   # failing areas / all areas in the report

Rationale: a row-count fraction on its own is a poor signal for "the environment drifted". Editing a single shared string across 26 locales and several widths produces a large count yet is perfectly attributable to one PR, and a partial or freshly regenerated baseline shrinks the denominator so that ordinary failures look proportionally huge — a real 24-screen failure confined to 3 areas measured 6.7 % and would have been misclassified as drift under the old threshold. Genuine SDK / Impeller / font drift is wide: it changes rendering itself, so it reds nearly every area. Requiring spread as well as volume separates the two shapes.

Both keys are read by the collector via --config; the breaker's boolean verdict plus the measured values are surfaced in its output so the playbook never recomputes them.