fix(ci): let the clang-tidy header filter match absolute paths so headers are ratcheted

[lusoris]

Summary

.clang-tidy's header filter could never match a header, so the ADR-1142 whole-tree ratchet has never counted one.

HeaderFilterRegex: '^(core/(include|src|tools|test)|python|ai)/.*\.(h|hpp|hxx|cuh)$'

clang-tidy tests that regex against the path as it saw it — from compile_commands.json, absolute: /home/…/vmafx/core/src/picture.h. An expression anchored at ^core/ cannot match that, so every in-repo header has been filtered as "non-user code" since the file was written. One translation unit (core/src/picture.c):

Suppressed 540 warnings (480 in non-user code, 60 NOLINT).
Use -header-filter=.* or leave it as default to display errors from all non-system headers.

Tree-wide, the CPU baseline holds 462 warnings in 72 files and not one is in a header, while the tree has 60 headers carrying 313 findings — core/src/feature/adm_tools.h alone has 142. Ledger L-45, reported by the CAMBI agent and confirmed by measurement.

The regex gains a (^|/) prefix — same file set, matched relative or absolute, nothing outside the repository (no system header contains /core/src/). ADR-1265 records the four alternatives (an .* filter, moving the filter into the script, keeping headers excluded as policy, fixing the regex without re-recording) and why each loses.

How the baselines are re-recorded

CPU lane — from CI, not from my machine. The Tidy Ratchet job measures with clang-tidy-22 on ubuntu-26.04 and uploads tidy-ratchet-cpu.json "to commit as the new baseline when the ratchet asks". A locally recorded file would carry a different clang-tidy and gcc and would drift immediately. So this PR has two commits: the fix (this one, whose Tidy Ratchet run fails by design and uploads the measurement), then that artifact committed verbatim as scripts/ci/tidy-baseline-cpu.json.

GPU lanes — locally, advisory. No CI job measures cuda, hip or sycl; their baselines are re-recorded with make tidy-ratchet-write LANE=<lane> on this machine (clang-tidy 22.1.8, /opt/cuda, /opt/rocm, oneAPI). Only headers next to each lane's translation units are attributed to that lane, per the ratchet's own ownership rule.

The measured CPU delta, for the record (local clang-tidy 22.1.8; CI's numbers will differ slightly and are the ones that land):

	Files	Warnings
Committed baseline	72	462
Measured with headers visible	115	744
of which headers	60	313

No source file changes in this PR. Nothing is cleaned; this is the first recording of a class the gate had never seen, which is why the "never raise the baseline" rule does not apply — there is no prior count to raise.

Type

• fix — bug fix (in the lint configuration)

Checklist

• Commits follow Conventional Commits.
• Pre-push hooks pass.
• I did not modify any assertAlmostEqual(...) score in the Netflix golden Python tests.
• docs/state.md: no state delta: a lint-configuration defect tracked as ledger L-45 / L-41; no bug in the fork's tracked set opens or closes.

Deep-dive deliverables (ADR-0108)

• Research digest — no digest needed: trivial. The whole diagnosis is the one Suppressed … in non-user code line and a two-line regex check.
• Decision matrix — ADR-1265 ## Alternatives considered, four options.
• AGENTS.md invariant note — scripts/ci/AGENTS.md, plus docs/rebase-notes.md.
• Reproducer / smoke-test command — below.
• CHANGELOG fragment — changelog.d/fixed/clang-tidy-header-filter.md.
• Rebase note — docs/rebase-notes.md.

Reproducer

meson setup build core -Denable_cuda=false -Denable_sycl=false -Db_lto=false && ninja -C build
clang-tidy -p build core/src/picture.c 2>&1 | grep 'non-user code'
# master:      Suppressed 540 warnings (480 in non-user code, 60 NOLINT).
# this branch: the header diagnostics are printed instead of suppressed.
python3 -c "import re; rx=r'^(core/(include|src|tools|test)|python|ai)/.*\.(h|hpp|hxx|cuh)$'; print(bool(re.search(rx, '/abs/path/vmafx/core/src/picture.h')))"   # False

Rebase hazard

If a sync or a tidy-config refresh restores the ^-only anchor, Tidy Ratchet will report every header as N -> 0 and ask to tighten. That is the filter breaking again, not a cleanup; scripts/ci/AGENTS.md and docs/rebase-notes.md say so.