The forge's own repository is never the target of a new forge's first ask #11417

A new forge's 'What do you want built?' always makes a new app and never files into the forge's own repository (leftover box of #11342).

Done looks like

• [x] firstAsk (and the page and MCP callers) refuse any path that resolves to the forge repository, with the plain words from tell_words.ts
• [x] A test in test/first-ask-new-app.test.ts fails without the guard: an ask naming/colliding with the forge's repo name still makes a separate app
• [ ] The refusal is receipted like the other first-ask errors

Files expected: src/actions/first_ask.ts, src/actions/apps.ts, test/first-ask-new-app.test.ts

Risks: name collision with a legit app called 'forge'; keep securityFloor untouched.

Suggested brief: scout (a person assigns). Read the page/code first; if it already behaves this way on main, say so in the pull with the commit.

Reviewed pull #11427 at its head: ticked firstAsk (and the page and MCP callers) refuse any path that resolves to the forge repository, with the plain words from tell_words.ts; A test in test/first-ask-new-app.test.ts fails without the guard: an ask naming/colliding with the forge's repo name still makes a separate app. left open: The refusal is receipted like the other first-ask errors — No receipt is written; like every other first-ask error it is only a flash, so receipting needs its own pull covering all of them..

Left open after pull #11427 landed: 1 unticked item remains (The refusal is receipted like the other first-ask errors). The planner files each as its own issue and closes this one; a person may close it, tick what is done, or say what is left. Until then the crew does not pick it again.