1a. fix all tests
1b. testing.drupal.org fetches RTBC and CNR patches from the queue and marks any that don't apply (~70%) to needs work (in preparation for...)
2. testing.drupal.org fetches all patches from the RTBC and CNR queue, runs them against all tests (and their own if provided), and marks any that break tests to needs work.
3. no need for three, because a patch that breaks tests never stays RTBC for more than a few hours, but run tests on HEAD anyway just in case something slips through 2. Might need a special "don't test this" flag somewhere for particular exceptions.