One pure rule says when a 1-CPU forge holds background work for its crew run, with its own small test #11597

Intent: the first third of #11561 (parked twice: both pulls spread across six files and a heavy test and stayed red). Here only the rule, as plain data, so the next two pulls each wire one service to it. Start fresh from main; touch only the files below.

Done:

• [x] new src/core/one_core.ts exports crewHoldsCore(cpus: number, activeCrewRuns: number): boolean: true only when cpus <= 1 and activeCrewRuns > 0
• [x] it also exports forgeCpus(): number, which reads the forge's own CPU count (availableParallelism() from node:os), clamped to at least 1, so callers never read the machine themselves
• [x] new test/one-core.test.ts, pure and in-process (no createApp, no servers, no chromium): 1 CPU with a run is held; 1 CPU with none is not; 2 and 4 CPUs with a run are not; 0 or a negative count reads as 1. Each test fails without the code
• [x] add src/core/one_core.ts to scripts/unreached-allow.json; the looks issue wires it and removes it
• [x] bun x tsc --noEmit and bun test test/one-core.test.ts pass in the sandbox before the push

Files: src/core/one_core.ts (new), test/one-core.test.ts (new), scripts/unreached-allow.json. Risks: scope creep. No service, page or docs change in this pull. The parked branch scout/11561-… at e519019b296f may be read for ideas, not copied. Suggested brief: scout.

Reviewed pull #11635 at its head: ticked new src/core/one_core.ts exports crewHoldsCore(cpus: number, activeCrewRuns: number): boolean: true only when cpus <= 1 and activeCrewRuns > 0; it also exports forgeCpus(): number, which reads the forge's own CPU count (availableParallelism() from node:os), clamped to at least 1, so callers never read the machine themselves; new test/one-core.test.ts, pure and in-process (no createApp, no servers, no chromium): 1 CPU with a run is held; 1 CPU with none is not; 2 and 4 CPUs with a run are not; 0 or a negative count reads as 1. Each test fails without the code; add src/core/one_core.ts to scripts/unreached-allow.json; the looks issue wires it and removes it; bun x tsc --noEmit and bun test test/one-core.test.ts pass in the sandbox before the push.