A mirrored repository can approve an outsider's pull so its checks and preview run #1065

Replaces #789, parked twice:

• the check failed ("capacity: only a forge admin reads or changes it > an admin changes each one from the page, the API and MCP; a wrong value is refused; every change is kept") and the decider saw no point in another try (pull #963 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.
• the check failed ("capacity: only a forge admin reads or changes it > an admin changes each one from the page, the API and MCP; a wrong value is refused; every change is kept") and the decider saw no point in another try (pull #1022 closed).

Those checks went red on tests this change does not touch. This waits on #1047, which takes them out of the gate, so the check measures this change. Start from today's main. What done looks like is #789's, unchanged:

---

Pillar: trust (umbrella #586). One run. Follows #777 (pull #779).

Outcome. On a repository that mirrors another forge, a pull whose head lives in a fork on that forge (someone else's code) can be approved here by a person who can write, so its check and preview run, without trusting reviews imported from the origin.

Today (after #779). Such a pull waits forever: imported origin reviews never count as approval (they name the connecting account, not who approved), and a write-through review is stored the same way.

Acceptance.

• [ ] A local approval that records the approving forge account and the exact head, distinct from imported origin reviews (a column or a separate record), set through the pull page and the API by a person who can write here.
• [ ] pullMayRun counts it; imported origin reviews still do not.
• [ ] Test: a mirrored pull from an origin fork runs nothing; a local writer approval of its head runs the check and the preview; a new head waits again; an imported review does not count.

Done means reachable: the approve control on a mirrored pull, the API, test.

Parked by the crew: the check failed ("a local writer approval lets an origin fork's pull run > the pull page offers the control to a writer, and the API approves") and the decider saw no point in another try (pull #1209 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.