Pages that name a thing describe it in one sentence from its live state, and a private one says only its name and 'private' #1412

Part of #591 (P5 Open to every agent). Replaces #1053. The layout already emits og:title/description/url/image and twitter:card (src/web/layout.ts pageDescription), so that part is done. What's left is that only six pages pass a description, so most links unfurl as the forge's generic line.

Done looks like.

• [ ] The issue, pull, run, user/org and app pages pass description: an issue's or pull's state and first line, a run's verdict and commit, a person's repo count, an app's live/asleep state.
• [ ] A page a signed-out reader cannot see renders its tags with no description from its data. A private repository, app or pull seen anonymously unfurls as its name and "private" only, never its body. A test proves it for one private repository and one private pull.
• [ ] Tests: a public issue's og:description is its first line; a private one's is not.
• [ ] A new test file is added to GATE in scripts/gate.ts in the same push (bun test test/check-list.test.ts is green); the last two tries went red on exactly this.
• [ ] If the check goes red on a test this change does not touch, the pull names that test and why it is unrelated; it does not widen the change to fix it.

Files. src/web/pages/issue*.ts, src/web/pages/pull.ts, the run, user and app pages, and src/web/layout.ts only if the private rule belongs there. Plus one new test file. Risks. Leaking a private body through a meta tag. Write the private test first.

Parked by the crew: the check failed ("report mode is loud to admins, and to nobody else > reported: the Capacity page says it once, as a note; vitals do not") and the decider saw no point in another try (pull #1417 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("dev's vocabulary never reaches a studio page > every studio page — home, app, tell, working, look, shipped, search and the three lists: no dev word, the studio chrome, the security floor, and a page a diff would never fit in") and the decider saw no point in another try (pull #1726 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("report mode is loud to admins, and to nobody else > reported: the Capacity page says it once, as a note; vitals do not") and the decider saw no point in another try (pull #1417 closed)
2. the check failed ("dev's vocabulary never reaches a studio page > every studio page — home, app, tell, working, look, shipped, search and the three lists: no dev word, the studio chrome, the security floor, and a page a diff would never fit in") and the decider saw no point in another try (pull #1726 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Deferred behind the Later gate (#595). The owner's direction of 2026-10-15 puts the check pipeline first, before any new feature: #1792, #1793, #1794, #1795, #1796, #1797, #1798, #1799, then #1789. Both tries went red on wide page-level suites (report mode, studio vocabulary); it is new page copy across many pages and waits for the pipeline work and the crew.test/apps.test split (#1798).

replaced by #1806. Correction to my note above: the Later gate refused it as a cycle (the gate waits on this pillar), so it is replaced instead, by an issue that waits for the owner's check-pipeline work it was failing on and that keeps its pillar.