GET /forges/<name>/ready says whether a new forge answers yet, and never holds its claim code #11201

Intent: the parent can tell a browser that a child it just made is up, so a stranger is never sent to a child still booting. Starts fresh from today's main; pull #8040 holds a working draft to borrow from.

Done:

• [x] GET /forges/<name>/ready answers {"ready":true|false} from the parent probing the child's /healthz through the existing probe seam (tests replace it)
• [x] a name that is not a valid child name is a 404; the answer carries no token and cache-control: no-store
• [x] strangers are rate-limited per caller (the existing anonymous limiter), a test proves the limit
• [x] the route has route timing and keeps securityFloor; a new test file is in the gate list

Files: a new src/web/pages/forge-ready.ts (or beside the spawn routes), src/http/server.ts, one test. Risk: the probe must time out fast (under 1 s) so a booting child never holds the parent's loop. Suits: a builder; sentinel reviews.

Reviewed pull #11214 at its head: ticked GET /forges/<name>/ready answers {"ready":true|false} from the parent probing the child's /healthz through the existing probe seam (tests replace it); a name that is not a valid child name is a 404; the answer carries no token and cache-control: no-store; strangers are rate-limited per caller (the existing anonymous limiter), a test proves the limit; the route has route timing and keeps securityFloor; a new test file is in the gate list.