scripts/drills/run.ts <domain> walks the operator through a standby drill, posts its result, and says so when the forge never comes back #2174

Replaces #1964 (parked twice; the work is in pull #1974, whose last review asked for one missing test). POST /api/v1/drills is on main and takes {domain, seen: {health, board}, backSeconds}.

Done looks like:

• [ ] bun scripts/drills/run.ts <domain> --forge <url> refuses a domain whose drill is null (from DOMAINS). It prints the fault to cause, waits for Enter, then polls /api/v1/health and / once a second, keeping each distinct line said while unhealthy. When healthy again it posts {domain, seen: {health, board}, backSeconds} to POST /api/v1/drills with FORGE_TOKEN from the environment and prints the verdict.
• [ ] Still unhealthy at the ceiling: it posts nothing, exits 0, prints one line saying the forge did not come back within the ceiling, and prints the JSON result line.
• [ ] A refused or failed post prints the forge's message and exits non-zero. It never shells out; zero dependencies; no migration, no server change.
• [ ] docs/DOMAINS.md says how to run it, with one full example command.
• [ ] Tests against a stubbed health server on a loopback port: goes down and comes back (asserts the posted body); stays down past ceilingMs (asserts status 0, no post, the message, the JSON line); refused post; unknown domain. Each new test file is named in GATE in scripts/gate.ts.

Files: scripts/drills/run.ts, test/drill-run.test.ts, docs/DOMAINS.md, scripts/gate.ts. Risk: timing-dependent tests; inject the clock and the poll interval.