Build CI orchestration from the trusted base checkout

[roshanasingh4]

Summary

The presubmit workflow currently merges proposed changes before building .ci/magician. Later build steps execute that binary while receiving Secret Manager-backed environment variables. As a result, changes to CI helper code in a pull request can replace the orchestration binary used by those steps.

This change:

• builds the Magician binary from the base branch before merging proposed changes
• preserves that pre-merge binary and launcher in a separate path
• uses the preserved launcher for subsequent generation and test steps

The proposed repository changes are still merged and tested as before; this only changes which version of the CI orchestration binary controls those steps.

Testing

• go test ./... in .ci/magician
• parsed the Cloud Build YAML and verified all 16 secret-bearing steps use the preserved launcher
• git diff --check

Release Note Template for Downstream PRs (will be copied)

[github-actions]

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@melinath, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.