feat: let a profile state that its upstream is gone

Saying those profiles would stay open no matter what was wrong. A dead
forge is a verifiable fact, and a fact can be recorded: upstream_gone
carries why, and the profile stops being an open problem. The refs
describe the last revision anyone could reach, which is all any reader
can ask of them.

The declaration is guarded rather than trusted, because a forge can come
back and a profile that keeps asserting a death nobody rechecks is worse
than one that fails loudly. Declared and unreachable reports as a
recorded fact; declared and answering reports as the contradiction it
is, and the profile has to be read again.

yuzu and suyu carry GitHub's 451. citron carries the loss of
git.citron-emu.org and the squatter now sitting on the .com. Each names
what was probed and when, so the next reader retraces it rather than
repeating it.

wiki/profiling.md

@@ -353,6 +353,8 @@ which CI validates every profile against.
 | `min_size`, `max_size` | size range when the code accepts a range |
 | `md5`, `sha1`, `crc32`, `sha256` | expected hashes from source code |
 | `known_hash_adler32` | expected Adler-32 hash (Dolphin's DSP ROMs); pair with `adler32_byteswap` when the code hashes 16-bit byte-swapped data |
+| `upstream_gone` | why the declared upstream can no longer be reached, when that is settled rather than transient. Records the death instead of leaving the profile failing every pass; profile_sync reports it as declared, and reports the contradiction if the forge answers again |
+| `source_mirror` | a repository carrying the same tree, consulted after `source` and `upstream`. What keeps a profile checkable once its own forge stops answering |
 | `validation` | checks the code performs: `size`, `crc32`, `md5`, `sha1`, `adler32`, `signature`, `crypto`. Can be a list or dict `{core: [...], upstream: [...]}` for divergent checks |
 | `aliases` | alternate filenames for the same file |
 | `mode` | `libretro`, `standalone`, or `both` |

wiki/tools.md

@@ -304,6 +304,12 @@ where nothing could be done about it. A 403 is not that: small Forgejo
 instances behind anti-bot filters answer 403 to a script and 200 to a
 browser, so it stays a refusal.
 
+When no mirror serves it either, `upstream_gone` states why, and the profile
+stops being an open problem: the refs describe the last revision anyone could
+reach and nothing further is possible. The declaration is guarded rather than
+trusted, since a forge can come back: a profile that declares it while the
+forge answers is reported as the contradiction it is.
+
 `source_mirror` names a repository carrying the same tree, consulted after
 `source` and `upstream` so a live primary always decides attribution. It is
 what keeps a profile checkable once its own forge stops answering: eden