Open the pull at the agent's first push, not when the run ends #1049

Replaces #10, parked twice:

• main moved under it 3 times and the branch could not be brought up to date (docs/APPS.md, src/crew/runner.ts, test/apps.test.ts, test/crew.test.ts) (pull #21 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.
• the check failed ("capacity: only a forge admin reads or changes it > an admin changes each one from the page, the API and MCP; a wrong value is refused; every change is kept") and the decider saw no point in another try (pull #993 closed).

Those checks went red on tests this change does not touch. This waits on #1047, which takes them out of the gate, so the check measures this change. Start from today's main. What done looks like is #10's, unchanged:

---

The forge already deploys a preview for every open pull in about twelve seconds, but an agent's pull only opens when its whole run ends — so the first time you can look at the app you asked for is nine to thirty-eight minutes after you asked. Open the pull on the agent's first push instead, and let the preview follow it commit by commit.

Measured here today (GET /api/v1/repos/:owner/:name/runs): the seven finished agent runs took 527s, 688s, 738s, 1018s, 1435s, 1630s and 2268s, and landWork in src/crew/runner.ts is the only place that ever calls openPull. Until it returns there is no pull, so no preview, so New app with a sentence means twenty minutes of staring at the scaffold. Little else has to change: AppsRuntime already redeploys a preview on pull.pushed, and landWork already finds an existing pull for the branch and comments its report onto it rather than opening a second one.

Acceptance

• [ ] When an agent run is active and its branch lands in the agent's fork with at least one commit beyond the base, the forge opens the pull for it — the title, base and head landWork would have used — within one worker tick of that push.
• [ ] An early pull's body says the work is in progress and links the run's log; when the run ends, landWork finds that pull, replaces the placeholder with the agent's report and the Closes #N trailer, and opens no second pull.
• [ ] A run that ends with DECLINED, or with nothing beyond the base, leaves no pull behind: an early pull with no commits of its own is closed with a comment saying why.
• [ ] test/crew.test.ts: a fake agent that pushes mid-run has an open pull — and a preview deploy run — before its run finishes, and exactly one pull when it does.
• [ ] test/crew.test.ts: a failed deploy of a work-in-progress push queues no check_failed follow-up while the authoring run is still active (src/crew/dispatch.ts), and leaves the CHECK_FAILED_LIMIT budget untouched for the runs that follow.
• [ ] src/crew/brief.ts tells the agent to push a first working commit early and keep pushing, and says the pull and its preview come up on that first push.
• [ ] docs/APPS.md, golden path step 2, says the pull appears at the first push rather than at the end.

Files I expect to change

• src/crew/runner.ts — the early open, and landWork adopting the pull it finds.
• src/crew/dispatch.ts — an in-flight run suppresses automatic check follow-ups on its own pull.
• src/crew/brief.ts — push early, and what that buys.
• test/crew.test.ts, docs/APPS.md.

The push event on the agent's fork is the natural seam — the outbox carries it, the dispatcher already listens — but a ref poll between turns inside the runner is fine too if it keeps branch knowledge in one module.

Risks

• Noise. A pull open for twenty minutes while an agent works is an inbox item that is not ready; it must read as in-progress everywhere it is listed, or Needs you stops being trustworthy.
• Loops. A work-in-progress push whose tests fail is a failed check, and a failed check re-engages the agent. Suppressing that while the authoring run is live is the one thing this change must not get wrong (rule 7, docs/APPS.md).
• Double proposals. openPull twice for one branch, or a pull opened for a branch the agent then abandons.
• Deploy pressure. Previews of half-built code take a slot in a gate two wide. Superseding a queued deploy handles a burst already; check it holds with a push every few seconds.

Who

Mason — surgery inside machinery that already works, where nothing may change except when the pull appears.

Parked by the crew: the check failed ("the crew, with a stand-in Claude Code > the pull opens at the first push, in progress, and the run's end fills it in") and the decider saw no point in another try (pull #1220 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("the crew, with a stand-in Claude Code > a decline after an early pull closes it with a reason") and the decider saw no point in another try (pull #1403 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("the crew, with a stand-in Claude Code > the pull opens at the first push, in progress, and the run's end fills it in") and the decider saw no point in another try (pull #1220 closed)
2. the check failed ("the crew, with a stand-in Claude Code > a decline after an early pull closes it with a reason") and the decider saw no point in another try (pull #1403 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split into #1461 (the pull opens at the first push and the run's end fills it in) and #1462 (a decline or failure after an early pull closes it with the reason). Each try went red on one of these two cases, so each now gets its own run. Builders can now run test/crew.test.ts in the sandbox, so each pull quotes it.