A run never falls back to the forge's own model credential: no grant to the repository or its owner, no run #1144

Pillar: P0 Trust (umbrella #586). First half of #656, a person's ask. Today a run on a repository with no model account falls back to the credential the forge process started with, which is the owner's.

Intent. Only an explicit grant pays for a run.

Done looks like.

• [ ] When a run starts, the runner takes a model credential only from a grant to the run's repository or to the repository's owner. With neither, the run does not start, spends nothing, and ends with "This repository has no model account" on its page and its issue.
• [ ] The forge's own repositories keep working, because the owner's grant to them is explicit (a migration records one for each repository the forge admin owns today). Nothing silently changes for the owner.
• [ ] Test: a fresh outsider account creates a repository, adds an existing agent, and opens and assigns an issue. The run does not start and the ledger shows no spend. The same flow on an owner repository with a grant starts.

Files. src/crew/runner.ts, src/crew/plan.ts, the grant lookup (src/crew/grant.ts), a migration, a test in the gate.

Risks. Stopping the owner's own crew. The migration and its test are the guard: compare runs started before and after on the forge's own repository.

Suggested: ledger.

Parked by the crew: the check stayed red through 2 automatic tries (pull #1156 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("a subscription's scope > one granted nowhere is never picked; one granted elsewhere is not picked here") and the decider saw no point in another try (pull #2085 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check stayed red through 2 automatic tries (pull #1156 closed)
2. the check failed ("a subscription's scope > one granted nowhere is never picked; one granted elsewhere is not picked here") and the decider saw no point in another try (pull #2085 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split into #2095 (the pick returns "none" for non-admin-owned repositories without a grant; admin-owned ones keep the fallback, so no migration) and #2096 (the runner refuses a "none" run, spends nothing, and says so). Both tries removed every fallback at once and the credentials suites that rely on it went red. #1145 now waits on #2096.