Vitals raises one need per domain whose last drill is red or eight days old, and nothing else changes #2019

Replaces #1854, which was parked twice: the first pull also added a "Domain drills" row to the terminal palette and pushed "Tell the crew" out of view (test/tui-tell.test.ts), and the second failed on an unrelated roll-rehearsal test.

Same shape as the restore-drill line in src/kernel/vitals.ts (drillNeed).

Done looks like:

• [ ] A pure function in src/kernel/domain_drill.ts takes each drillable domain's newest drill (from src/core/domain_drills.ts, one query) and now, and returns one need per domain whose last drill is red, or whose last green drill (or the forge's first-seen time, when it has none) is more than eight days old. The sentence names the domain and the failing phrase from the drill's reason, and links to /settings/backups.
• [ ] vitals raises those needs; a domain's next green drill clears its need.
• [ ] Tests with a fixed clock: red raises the need and names the phrase, green clears it, eight days with none raises it, and a forge with no drillable domain (or no first-seen file) raises nothing.
• [ ] Scope: no terminal palette row, no page, no route. The Resilience page is #1853's.
• [ ] Before pushing, run test/asks.test.ts ("All fine" stays green), test/vitals.test.ts, test/domain-drill.test.ts, test/tui-tell.test.ts, and the new test file, plus bun x tsc --noEmit.

Parked by the crew: the check failed ("the board's forge strip > an admin reads All fine; a stuck run becomes a linked sentence; a non-admin sees nothing") and the decider saw no point in another try (pull #2025 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Replaced by #2175. The new issue says what done looks like now. It adds the last review's ask on the pull as a checkbox, and everything that waited on this issue now waits on #2175.

Closed: already done on main in a635a9b5 (pull #2055).