List grouped error fingerprints with a release-baselined verdict

The platform's durable error memory: uncaught throws, boot crashes (init crash-loops that never produce an app log line), invoke-level failures (throttle exhaustion, payload caps), and coarse handled-5xx — grouped by deploy-stable fingerprint and attributed to the release each identity was first seen under. The response LEADS with a computed verdict (new/recurring counts vs the baseline release, invocation volume, fidelity coverage). new_in=<release_id|active> is the promote-gate query: run402 errors list --new-in <release_id> --watch 10m --fail-on-new exits 0 when no new identities appeared. Platform traffic-shaping denials (rate limits, auth gates) are never counted as app errors. Auth: the project's own apikey OR a GitHub-OIDC CI session bearer for its own bound project (a deliberate, scoped v1.36 widening — a CI session already has deploy authority, so reading the resulting fingerprints is strictly less power and makes the promote gate keyless). Read-only, own-project-only; a CI session bound to a different project gets 403, a revoked binding 401.