A contrib pull's check runs in the outside lane and nothing from its branch is previewed before an approval #12102

Split from #12014. The ordering half, independent of check.txt.

Done when:

• A check for a pull opened with a contribute token is queued in the outside-contributor lane: with owner or crew work queued, the owner's work runs first (see src/checks/queue.ts, placement.ts).
• No preview is deployed from a contrib pull's branch until a person or the reviewer approves it; after the approval the preview deploys as for any pull (reuse src/checks/approval.ts, do not add a second approval path).
• Tests: a queued contrib check runs after an owner check queued later; a contrib pull has no preview before approval and has one after.
• docs/features/contribute-token.md says both in a sentence each.

Files: src/checks/queue.ts or placement.ts, the preview deploy decision, one test file, the doc. scout/12014-a-contrib-pull-s-check-reads-as-plain-te at 3252fc14f65d started a src/checks/outside_lane.ts; read it, keep what fits.

Risk: slowing the crew's own checks — the test that the owner goes first is the guard; nothing in the lane changes for pulls that are not contrib.