Vitals raises one need per domain whose last drill is red or eight days old, and the need says the exact command that runs the drill #2175

Replaces #2019 (parked twice; pull #2055's logic was approved in substance but its need sent people to /settings/backups, which has no domain drills, and its example request was a placeholder missing required fields). Same shape as drillNeed in src/kernel/vitals.ts.

Done looks like:

• [ ] A pure function in src/kernel/domain_drill.ts takes each drillable domain's newest drill (one query over domain_drill) and now, and returns one need per domain whose last drill is red, or whose last green drill (or the forge's first-seen time, when none) is more than eight days old. Domains never drilled collapse into one need, not one each.
• [ ] The need names the domain, the failing phrase from the drill's why, and the exact command to run it: bun scripts/drills/run.ts <domain-key> --forge <this forge's URL>, with the real key and URL filled in and escaped. It links to no page that lacks domain drills.
• [ ] vitals raises those needs; a newer green drill clears a domain's need. Nothing else changes: no palette row, no new page.
• [ ] Tests with a fixed clock: red raises and names the phrase; a newer green clears; the eight-day edge both sides; never-drilled collapses into one need; the command text is the real key and is escaped; the vitals query count test is updated.

Files: src/kernel/domain_drill.ts, src/kernel/vitals.ts, test/vitals*.test.ts. Risk: the vitals query budget; read every domain in one query.