The forge's failure domains as data: src/kernel/domains.ts and docs/DOMAINS.md, each domain's words quoted from what the forge already says #1850

Split from #1195 (part of #1148). Only the map: no drills, no page, no endpoint.

Done looks like:

• [ ] src/kernel/domains.ts exports plain data for seven domains: compute (the pod), state (the volume), the snapshot store, the edge (tunnel and DNS), identity, the model credential, the runner. Each has: what breaks, the forge's words (says), minutes until back, what the owner does, and drill: a name, or null with one sentence on why it can't be drilled without harm.
• [ ] Every phrase in says is text the forge already emits today: copied from src/kernel/vitals.ts, /api/v1/health or the board, not drafted. (Pull #1720 went red because its drafted runner phrase did not match what a stalled check queue says.) Where a domain has no words yet, says is empty and the doc says so. Don't add new words in this issue.
• [ ] docs/DOMAINS.md is one page with a table that matches the data.
• [ ] test/domains.test.ts: the doc and the data agree, and each says phrase is produced by the real function that emits it, with a stubbed condition (e.g. a check queued past QUEUE_WAIT_MAX_MS makes vitals say the runner's phrase). Name it in GATE in scripts/gate.ts in the same commit.

Files: src/kernel/domains.ts, docs/DOMAINS.md, test/domains.test.ts, scripts/gate.ts. Before pushing: bun x tsc --noEmit and bun test test/domains.test.ts test/vitals*.test.ts.