A repository mirrored from a read-only origin is private to its owner everywhere #10520

Part of #10414.

Done:

• [x] A repo mirrored from a read-only origin is created private and cannot be made public while the origin is read-only (origin_read_only on the visibility change).
• [ ] It never appears in public pages, the changelog, Talk, search for anyone but the owner, or a crew brief; a test reads each of those as a stranger and as a crew agent and finds no trace of its name or commits, and reads them as the owner and finds it.
• [x] bun test test/origin-read-only-private.test.ts passes.

Files: src/actions/origins.ts, src/origins/mirror.ts, test/origin-read-only-private.test.ts Risks: the leak is through lists and counts, not only the repo page; filter before counting. Suggested: scout.

Reviewed pull #10637 at its head: ticked A repo mirrored from a read-only origin is created private and cannot be made public while the origin is read-only (origin_read_only on the visibility change).; bun test test/origin-read-only-private.test.ts passes.. left open: It never appears in public pages, the changelog, Talk, search for anyone but the owner, or a crew brief; a test reads each of those as a stranger and as a crew agent and finds no trace of its name or commits, and reads them as the owner and finds it. — The test reads no crew brief; it substitutes an agent account reading the pages. The brief remains unverified..

Left open after pull #10637 landed: 1 unticked item remains (It never appears in public pages, the changelog, Talk, search for anyone but the owner, or a crew brief; a test reads each of those as a stranger and as a crew agent and finds no trace of its name or commits, and reads them as the owner and finds it.). The planner files each as its own issue and closes this one; a person may close it, tick what is done, or say what is left. Until then the crew does not pick it again.

The open box is now #10660 (no trace for a stranger or the crew, tested surface by surface).