patches: onboard-ready 3.4.11 selection + bounded overlay carry (until:)

[ronaldtse]

Refs #116

What

Makes the ruby 3.4.11 onboard go green, per the triage on #116:

1. patches/3.4/patch-3.4.yaml — two selection pins at version: "11": prism_compile_memfs → prism_compile_memfs_6.patch, openssl_extconf_ruby_export_msys → openssl_extconf_ruby_export_msys_10.patch.
2. patches/3.4/patch-3.4.7.yaml — the CRL default-store removal entry gains until: "7": the overlay carry ends at 3.4.7.
3. Tooling — the minimal model for that end-bound: overlay entries gain an optional until: "<patch>" key (schema/patches.schema.yml, Tfs::PatchManifest::Entry#until + #carriable_to?). The onboarder drops bound-expired entries from the carry candidates (reporting them on the Result as dropped) and preserves the bound in overlays it writes, so the end survives further carries. No selection-semantics change: an overlay still applies to its own exact patch level only.
4. Specs: until parse/reject (patch_manifest_spec), carry drop / bound preservation / bound surviving into the next onboarding (onboarder_spec). README synced.

Triage evidence (why no rebase is needed)

All fifteen monitor filings report the same three patches. Verified against the official pristine tarballs (git apply --check):

patch	hunk that failed	upstream cause	verdict
prism_compile_memfs.patch (whole-line)	prism_compile.c:1 (@@ -1,5)	selection fell back to the stale pre-3.4.6 body (3.4.6 added #include "version.h" at line 2). 3.4.11's real upstream diff — VM_CALL_KW_LEN_MAX "too many keyword arguments/parameters" guards and the PM_KEYWORD_HASH_NODE assoc-splat rework via pm_compile_hash_elements — never touches the patched hunks	prism_compile_memfs_6.patch applies cleanly to 3.4.11 → pin at "11"
openssl_extconf_ruby_export_msys.patch (whole-line)	ext/openssl/extconf.rb:208 (@@ -208,8)	the 3.4.10 openssl-gem bump inserted have_func("ASN1_BIT_STRING_set1…") after the anchor (why _10 exists); extconf.rb is byte-identical 3.4.10 → 3.4.11	openssl_extconf_ruby_export_msys_10.patch applies cleanly → pin at "11"
openssl_ssl_default_store_crl_removal.patch (carried from the 3.4.7 overlay)	ext/openssl/lib/openssl/ssl.rb:92	the vendored ssl.rb already ships without V_FLAG_CRL_CHECK_ALL since 3.4.8 (the upstream removal the patch mirrors) — ssl.rb is byte-identical 3.4.10 → 3.4.11; the patch fails on both	obsolete → until: "7" ends the carry; no patch becomes necessary

Before/after selection

version	feature	before	after
3.4.11	prism_compile_memfs	prism_compile_memfs.patch (whole-line, fails)	prism_compile_memfs_6.patch @ "11"
3.4.11	openssl_extconf_ruby_export_msys	openssl_extconf_ruby_export_msys.patch (whole-line, fails)	openssl_extconf_ruby_export_msys_10.patch @ "11"
3.4.11	openssl_ssl_default_store_crl_removal	carried from 3.4.7 overlay (fails, fatal)	dropped (dropped: ["openssl_ssl_default_store_crl_removal"]), no overlay written
3.4.10	all	—	byte-identical (35 patches, diff-verified vs origin/main)

Verification runs (all local, pristine official tarballs)

• bundle exec tools/monitor --onboard 3.4.11 (the real monitor flow, sha256-verified tarball): OK 3.4.11 onboarded — applied: true, failing: [], dropped: ["openssl_ssl_default_store_crl_removal"], only versions.yml written, no patch-3.4.11.yaml. The versions.yml pin is not part of this PR — the monitor's next run performs the actual onboard (Onboard ruby 3.4.11: patches fail to apply #116 stays open until that run is green).
• tools/lint 3.4.11 → OK 3.4.11 (34 patches apply cleanly); tools/lint 3.4.10 → OK 3.4.10 (34 patches apply cleanly).
• Compile-smoke gate: tools/compile_smoke 3.4.11 --platform darwin → OK … 8 patched translation units compile (… compile.o …); same for 3.4.10 → OK. (compile.o covers the #included prism_compile.c; host legs are darwin — the CI matrix covers the rest.)
• bundle exec rspec → 121 examples, 0 failures; tools/validate_manifests → all manifests valid.