ci: enforce clean per-commit SP11 source deltas

[ooaklee]

Summary

Strengthen the SP11 beta validator without hiding the existing beta-wide checkpatch debt. On pull-request runs, the script derives the current beta tip and real topic head from the checked-out synthetic merge, requires a current linear topic, and runs strict checkpatch on each source-changing commit independently. Any new source ERROR, WARNING, or CHECK fails the job.

Why per commit

The aggregate check remains useful for the complete integration delta, but it collapses intentional commit boundaries. That can create synthetic findings such as a binding-and-driver warning even when those changes are correctly split across patches. Kernel submissions are reviewed as patches, so the new gate evaluates each real topic commit while retaining the aggregate report for historical findings.

Guardrails

• require the topic head to descend from the current beta tip; stale topics must be re-lifted;
• reject merge commits in a topic range;
• run checkpatch.pl --strict on every source-changing commit and reject all three finding severities;
• retain full-delta artifact, binary, private-content, ancestry, whitespace, and aggregate checkpatch checks; and
• keep DCO/provenance review separate so contributor trailers are never invented merely to satisfy automation.

Validation

• bash -n: pass
• git diff --check: pass
• current beta-wide validation: pass with the same documented 0 errors, 3 warnings, and 3 checks
• exact two-parent synthetic PR checkout: pass; base/head parent derivation and one-commit review confirmed
• current topic simulations: ASoC: re-lift guarded SP11 TX DMIC capture #36 (3 commits), platform/surface: re-lift SP11 battery-provider containment #37 (2), platform/surface: re-lift contained SP11 platform profile #38 (3), media: qcom: restore SP11 camera parity gaps #40 (7), dmaengine: qcom: gpi: order event ring pointer reads #45 (1), ASoC: restore guarded SP11 Golden playback parity #47 (38), [QUALIFICATION - DO NOT MERGE] SP11 v8 GPI ordering test #46 (2), and [QUALIFICATION - DO NOT MERGE] SP11 v9 audio TOP_CFG1 test #48 (39): pass with zero per-commit source findings
• incomplete PR metadata: rejected
• stale/non-descendant head: rejected
• known DWC3 source-check finding: rejected at its exact commit

Two independent read-only OpenCode reviews found no gate-bypass defect. The second review specifically approved synthetic-merge parent ordering, Bash behavior, ancestry direction, and linearity enforcement. The workflow already checks out 256 commits, covering every current topic range.

This PR changes CI only and requires no hardware qualification.