[DanielNetzer]

Closes #224.

Adds forgecell init --refresh-baseline [--lab DIR]. It re-derives the CI baseline from the current pull-request workflows and saves a pending proposal that changes only the top-level requiredChecks of the approved Formula. Review and approval go through the existing init --review/--approve/--dismiss ID flow, which binds the exact saved bytes. It mirrors --rebind:

• Diff guards: maskBaselineKeys and verifyBaselineDiff refuse a proposal that changes any other key. verifyBaselineExact requires the proposal to equal the approved Formula plus the derived checks.
• In-place edit: the YAML is spliced in place, so everything outside the block stays byte-for-byte. Flow style, anchors, aliases and keys outside column 1 are refused.
• Empty and unchanged: an empty derived baseline is refused while protected checks exist, and an unchanged baseline is a no-op that saves nothing.
• Note: lists each added, changed or removed check (id, argv, timeoutMs old→new), plus the workflow file and SHA-256 it came from.
• Guards: same as --rebind: refused while a proposal is pending, without an approved Formula, or without a current exact approval. It conflicts with --harness, --rebind, --meta-*, --model, --role, the timeout flags and --review/--approve/--dismiss.

This unblocks the approved Formula update: baseline go test -timeout 20m ./... at 1500000.

Built by Forgecell Molecule mol-224-37b068e838f267e806d6363d (plan f58ca943, base 00d8fe3). Its targeted onboarding+cli checks passed. Hand-delivered: the candidate's full-suite baseline failed only on Go's 10-minute timeout in the unrelated evaluation package under parallel load, the issue this wave fixes.

Review: one independent adversarial pass found no HIGH or correctness-MEDIUM issues. It checked the splice range against lastLine, comment, trailing-content and multi-document cases (all refused safely or preserved), the guard parity, and that the note leaks nothing.

Local clean-shell suite: gofmt and vet clean. go test -timeout 25m ./... hit one known #220 flake (TestNativeBindingPassesAllowlistToClaudeArgv, a 10 s wall-clock budget in molecule, a package this PR doesn't touch) while #220's -count=5 load checks were running. CI is the gate.

LOW (not fixed): the appended-key path trims trailing blank lines (formatting only), and the baseline reads the current working tree, as bootstrap does (the note's revision and SHA make that visible).

🤖 Generated with Claude Code