Fast test/apps.test.ts: one forge per file, a fake clock, under 10 s with every test under 1 s #1287

For P0 Trust, under the fast suite (#1242). This replaces #1246, which was parked twice.

test/apps.test.ts took 148.5 s alone in scripts/test-times.json, so it sits in SLOW in scripts/gate.ts under #1246. It has 46 tests in 14 describe blocks, with 11 beforeAll forges and 7 sleeps.

Done looks like

• [ ] bun test test/apps.test.ts runs in 10 s or less, and every test in it takes 1 s or less. The pull quotes the before and after timings.
• [ ] The file's SLOW entry is removed from scripts/gate.ts in the same pull.
• [ ] Every Bun.sleep is gone from the file. The idle and readiness cases use the app's injectable clock, or a hook the app already exposes.
• [ ] The pull's check is green. If it goes red in a file this pull didn't touch, the pull names that file and test and does not edit it.

How (the owner, on #1242: chop and rewrite, not trim). Above each test, write the invariant it proves in one line. Then write the fastest test that proves that line. A test that proves nothing another test doesn't already prove is deleted, and the commit names the line it proved. Boot one forge and one server per file, in beforeAll. Use a fake clock, never Bun.sleep. Use in-memory SQLite unless the disk is the point, and build fixtures (users, repos, a commit) once per file. No chromium, bwrap or real network in the gate. A test that is slow by nature moves to NIGHTLY in scripts/gate.ts, with its reason.

Why it waits on #1163. Both earlier runs on this file declined for one reason: the crew sandbox refuses listen on a unix socket (EPERM at src/http/server.ts Bun.serve({ unix })). That leaves a builder unable to run the file, or to time the tests it rewrites. Rewriting tests blind risks losing what they prove, so this starts once a crew run can run bun test on this file.

Files: test/apps.test.ts, scripts/gate.ts, and a shared helper under test/helpers/ if one fits.

Risks. Coverage loss is the risk. Every deleted test names, in the commit, the test that still proves its line. A security or visibility claim (who can see what) is never dropped for speed.

Brief: a builder (scout or mason). Assign nobody until #1163 lands.