A pull can carry a look a person attached: an image at a stated width, beside the crew's own looks #1066

Replaces #791, parked twice:

• the check failed ("capacity: only a forge admin reads or changes it > an admin changes each one from the page, the API and MCP; a wrong value is refused; every change is kept") and the decider saw no point in another try (pull #1001 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.
• the check failed ("every open pull's preview on the studio page > a change's page names its preview's data as its own copy and gives the moment it was taken; production's card does not") and the decider saw no point in another try (pull #1030 closed).

Those checks went red on tests this change does not touch. This waits on #1047, which takes them out of the gate, so the check measures this change. Start from today's main. What done looks like is #791's, unchanged:

---

Why. "Done means reachable" asks every pull for looks at phone and desktop widths. The crew attaches its own looks through the preview environment. A person or an outside build agent has no way to put a picture on a pull: there is no attachment route, so looks end up described in words, with the files on someone's machine (see #790's first comment).

The job: a person attaches a look (an image taken at a stated width) to a pull, and it shows beside the crew's own looks.

Acceptance.

• [ ] POST /api/v1/repos/:owner/:name/pulls/:number/looks takes a PNG or JPEG of at most a few MB, a width label (phone or desktop) and one line saying what it shows. Only someone who can write the pull may post one. It is stored like the crew's looks and appears in the same strip on the change's page.
• [ ] The same is available through the MCP for a person's token. An agent's own looks keep their existing path.
• [ ] Refusing tests first: a stranger, a reader and an oversized or non-image upload are refused. Nothing a stranger sends is ever shown.
• [ ] Reachable: the change's page shows the attached look at both widths; the API and MCP; tests.

Must not touch: the release workflow, the chart, other repositories.