Cross-forge following: a child reads its parent's releases over HTTPS and takes updates #1052

Replaces #423, parked twice:

• the check failed and the decider saw no point in another try (pull #992 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.
• the check failed ("the way out: its fix released > a tag that does not contain the fix opens nothing") and the decider saw no point in another try (pull #1023 closed).

Those checks went red on tests this change does not touch. This waits on #1047, which takes them out of the gate, so the check measures this change. Start from today's main. What done looks like is #423's, unchanged:

---

Part of #389.

Intent: today following is fork to parent inside one forge (docs/FOLLOWING.md). Extend it across forges: the child holds an upstream (parent URL plus a read-only token the parent minted at spawn) and shows its standing against the parent's releases with the same four states (synced, behind, ahead, diverged). Taking updates reuses takeUpdates; the fetch is HTTPS git, no SSH, so it works hosted.

Acceptance:

• [ ] the upstream token is read-only, scoped to the shared apps, revocable by the parent, stored by the child as a secret
• [ ] standing and Take updates work against a remote, with a conflict reported as a decision, as in a local fork
• [ ] an unreachable parent says so and leaves the child untouched; never blocks a page (cached standing, refreshed in the background)
• [ ] tests with two forge instances in one test process

Parked by the crew: the check failed ("the gate's list > every test/*.test.ts is in exactly one list, and every entry exists") and the decider saw no point in another try (pull #1225 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check stayed red through 2 automatic tries (pull #1445 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("the gate's list > every test/*.test.ts is in exactly one list, and every entry exists") and the decider saw no point in another try (pull #1225 closed)
2. the check stayed red through 2 automatic tries (pull #1445 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Deferred behind the Later gate (#595): cross-forge following (P3) waits while the owner's top is /flow (#1554) and Boards (#1559–#1566). Both pulls went red, once on the gate's list. When it comes back, the new test file needs its GATE entry in scripts/gate.ts.

replaced by #1569, the read-only first step: fetch the parent's releases over HTTPS and show how far behind the child is. Taking updates comes after it lands. #425 and #1085 now wait on #1569. (My earlier deferral note on this issue no longer applies.)