Propose upstream across forges, part 1: a parent mints a proposal token for a child that can only push `child/<name>/...` branches and open pulls #1831

Split from #424. For: a child forge's improvement can go back to its parent without the parent handing out write access.

Done looks like:

• [ ] A writer of a parent repository mints a proposal token for one named child (in src/core/tokens.ts' shape, sealed like other tokens); it can push only branches under child/<name>/ over HTTPS and open pulls from them. A push to the default branch or any other ref is refused with one line; every other API is a 403.
• [ ] At the parent, a pull opened by it names the child and its origin, escaped wherever it renders; proposals are rate-limited per token and a body over the size limit is refused.
• [ ] Tests in a new file named in GATE: refused on main, refused outside the namespace, a hostile branch name (child/x/../../main, control characters) refused, an oversize body refused, rate limit enforced. Run the spawn, children and git push tests with it (the earlier tries went red and then failed their deploy).

Replaced by #2176. The new issue says what done looks like now. It adds the last review's ask on the pull as a checkbox, and everything that waited on this issue now waits on #2176.

Closed: already done on main in 7dcf24c9 (pull #2210).