A queued pull check waits while a crew run holds the only core, and starts when it ends #11775

Part of the 1-CPU rule (#11561). Two earlier tries at the whole of #11599 went red; this is its first half only: checks, no snapshots.

Done looks like:

• [x] pickNext (or the loop that calls it) in src/checks/service.ts starts no new pull check while crewHoldsCore(...) (src/core/one_core.ts) is true. Queued checks keep their order and start when the run ends. A check already running is left alone.
• [x] The merge gate (main's check) is never held, so a red main is never held forever.
• [x] The CPU count and the active-run count are injectable through the service's options; tests need no real size, servers or crew loop.
• [x] New test/checks-one-core.test.ts, in-process: 1 CPU with a fake active run holds a queued check and it starts once the run is gone; 2 CPUs start it at once; the gate starts on 1 CPU while a run is active. Each test fails without the change.
• [x] bun x tsc --noEmit and bun test test/checks-one-core.test.ts pass in the sandbox before the push; list the new test in scripts/gate.ts if it still lists tests by hand.

Files: src/checks/service.ts, test/checks-one-core.test.ts Risks: the earlier branch scout/11599-on-a-1-cpu-forge-checks-and-snapshots-st holds work to read first; its first try touched five files, keep to two. No docs change.

Reviewed pull #11793 at its head: ticked pickNext (or the loop that calls it) in src/checks/service.ts starts no new pull check while crewHoldsCore(...) (src/core/one_core.ts) is true. Queued checks keep their order and start when the run ends. A check already running is left alone.; The merge gate (main's check) is never held, so a red main is never held forever.; The CPU count and the active-run count are injectable through the service's options; tests need no real size, servers or crew loop.; New test/checks-one-core.test.ts, in-process: 1 CPU with a fake active run holds a queued check and it starts once the run is gone; 2 CPUs start it at once; the gate starts on 1 CPU while a run is active. Each test fails without the change.; bun x tsc --noEmit and bun test test/checks-one-core.test.ts pass in the sandbox before the push; list the new test in scripts/gate.ts if it still lists tests by hand..