Packs come from the forge: each app is a forge mirror, each pack is a forge repo #10447

Packs come from the forge, not GitHub. The owner: "packs also appears to be using GitHub… it should be using the forge."

Today packs/*/pack.json lists upstream GitHub URLs as each app's source: memos, kanboard, 2048, hextris and react-tetris. They live inside the forge's own source tree.

The direction is the same one as the template (#10305): packs are repos on the forge.

Done when:

• Each upstream is a forge repo. It's brought in once as a read-only mirror under a packs owner (for example packs/2048), with its licence, original authors and upstream link shown on the repo page. Re-syncs happen on a schedule, and the forge is the only thing a deploy reads from.
• Each pack is a forge repo (for example packs/games). Its pack.json lists forge repos (packs/2048), not URLs. /packs reads the marked pack repos, the same way new apps read the marked template repos, and packs/ leaves the forge's source tree. The Dockerfile COPY packs goes away with it.
• Deploying a pack forks each app from its forge mirror into the person's account, with lineage so the upstream credit carries through. GitHub is never touched at deploy time, and a test proves it with network to github.com refused.
• Adding one. Anyone can make a pack by making a repo with a pack.json, and the owner marks which ones appear on /packs.

Parked by the crew: the check stayed red through 2 automatic tries (pull #10455 closed; its branch mason/10447-packs-come-from-the-forge-each-app-is-a at b70844dc430f keeps the work so far). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check stayed red through 2 automatic tries (pull #10477 closed; its branch mason/10447-packs-come-from-the-forge-each-app-is-a at 292a0fa8479c keeps the work so far).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check stayed red through 2 automatic tries (pull #10455 closed; its branch mason/10447-packs-come-from-the-forge-each-app-is-a at b70844dc430f keeps the work so far)
2. the check stayed red through 2 automatic tries (pull #10477 closed; its branch mason/10447-packs-come-from-the-forge-each-app-is-a at 292a0fa8479c keeps the work so far)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split by the planner: the second red was the lane's shared failure (live previews test, #10528), but the issue was four changes in one pull. Now: #10529 a pack app may name a forge repo and deploy forks it with lineage (no network); #10530 the upstreams become read-only mirrors under packs/, re-synced; #10531 the mirror page credits upstream, licence and authors (after #10530); #10532 /packs reads marked pack repos and packs/ leaves the source tree (after #10529 and #10530). The work on mason/10447-packs-come-from-the-forge-each-app-is-a (292a0fa8479c) is a starting point for #10529 and #10532.