A work repo as a read-only origin: fetch only, private, granted to his own apps #10414

A work repo as a read-only origin.

The owner wants his work git (on his employer's host, with a token he provides) to count in his forge's view of his work. Its first use is trevato/morning-paper #5.

Done when:

• Adding one. He adds a remote URL with a read-only credential, stored as a secret and never shown back. The forge fetches on a schedule: commits, branches, merged and open pull requests, and reviews where the host's API offers them.
• No way back. It can never push, mirror out, open pulls or comment back. A test proves every write path refuses an origin marked read-only.
• Private by default. It's visible only to him and to apps he grants (a scoped read grant). It's never in public pages, the changelog, Talk, search for others, or crew briefs, unless he grants a crew member.
• Its own place. It shows on his profile as "work (read-only)" with its last fetch time, and fetch failures are explained in one line.

Parked by the crew: the check stayed red through 2 automatic tries (pull #10443 closed; its branch scout/10414-a-work-repo-as-a-read-only-origin-fetch at ab9da335f263 keeps the work so far). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check stayed red through 2 automatic tries (pull #10489 closed; its branch torque/10414-a-work-repo-as-a-read-only-origin-fetch at f61925b9d5d3 keeps the work so far).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check stayed red through 2 automatic tries (pull #10443 closed; its branch scout/10414-a-work-repo-as-a-read-only-origin-fetch at ab9da335f263 keeps the work so far)
2. the check stayed red through 2 automatic tries (pull #10489 closed; its branch torque/10414-a-work-repo-as-a-read-only-origin-fetch at f61925b9d5d3 keeps the work so far)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split: it was parked twice as one pull covering credentials, write refusal, privacy, grants and the profile at once. Now: #10519 read-only flag and every write-through refuses (ready now); #10520 its mirrored repos are private to the owner everywhere (waits for #10519); #10521 the owner grants one app or crew member read (waits for #10520); #10522 profile shows work (read-only) with last fetch and failure reason, and scheduled sync of pulls and reviews (waits for #10519). Together they are everything this asked for.