test/web-apps.test.ts: the run page case reads the run's state and the page in an order that cannot disagree #1076

Replaces #967, parked twice:

• the check failed ("capacity: only a forge admin reads or changes it > an admin changes each one from the page, the API and MCP; a wrong value is refused; every change is kept") and the decider saw no point in another try (pull #989 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.
• the check failed ("capacity: only a forge admin reads or changes it > an admin changes each one from the page, the API and MCP; a wrong value is refused; every change is kept") and the decider saw no point in another try (pull #1021 closed).

Those checks went red on tests this change does not touch. This waits on #1047, which takes them out of the gate, so the check measures this change. Start from today's main. What done looks like is #967's, unchanged:

---

Pillar: P0 Trust (#586). Split from #842, which was parked twice on other files' flakes.

"the runs list, one run's log page, and the short door to it" (test/web-apps.test.ts, around line 338) renders /alice/hello/runs/<id> and then reads the run's state to decide whether data-stream= should be on the page. If the deploy finishes in between, the page says "going" while the state says "done": Expected: false, Received: true.

Done looks like

• [ ] The case waits for the run to settle before it renders, or it reads the state before and after the render and asserts only when they agree. It still proves both forms: stream and refresh while the run is going, and neither once it is done.
• [ ] Only test/web-apps.test.ts changes. It passes 20 times in a row with test/studio.test.ts running alongside. Quote the loop's output.
• [ ] Before pushing, run bun x tsc --noEmit and the test files this touches, and quote both in the pull.

🤖 Generated with Claude Code