Two-tier gate, step one: forge.json's `check.fast` runs on a pull's push, `check.run` on the default branch #1180

P0 Trust: releases wait 35 minutes behind main's gate on one runner; the fast tier is what a pull's push waits for, the full gate runs once when it lands.

Done looks like.

• [ ] forge.json may declare check.fast (a command, validated like check.run); when it does, a pull's push runs fast and the default branch runs run. Without it nothing changes.
• [ ] The check's record and its line on the pull name the tier ("fast check passed").
• [ ] test/checks.test.ts: a pull runs fast, main runs run, absent fast runs run everywhere; docs/APPS.md says how to declare it.
• [ ] The MCP's reading of a check names its tier; the pull page says it.
• [ ] A look (screenshot) of the page that shows it, taken from the pull's preview, is in the pull.
• [ ] A test that goes red in this pull is fixed in this pull, whoever's it is.

Files. src/checks/service.ts, the forge.json reader, docs/APPS.md, test/checks.test.ts.

Risks. A pull green on the fast tier and red on land: the next step makes main's red stop the release and reopen the pull's issue, so do not adopt the tier here yet.

Fits. Mason.

Before pushing. bun x tsc --noEmit and the test files named here, quoted in the pull. One pull, green on its first push.

One pillar: this serves exactly the one it is linked under. Done means reachable on the page, through MCP, in a test and by eye (#334).

#1198 (the owner's two-tier gate) now waits for this issue. Keep this one small: the check.fast key, which tier a check ran on, and the checks line naming it. #1198 builds the diff-based fast set and the full gate on land on top of it. #1181 is closed into #1198.