The forge pill says where you are (app, production or preview of pull #n with its title, a link home) and closes on a tap outside it #2178

Replaces #1502 (parked twice). Pull #1696's data and escaping passed review. Its last ask: on a phone there is no Escape key, so the open panel can only be closed by tapping the pill again.

Done looks like:

• [ ] The proxy passes the app, the environment and, for a preview, the pull number and title to the pill as escaped data attributes. The title is withheld from viewers who may not read the pull.
• [ ] Expanding the pill shows these values, and Home goes to the feed. Text goes in with textContent only. The href is checked against the forge's origin.
• [ ] The panel closes on Escape, on a tap on the pill, and on a pointerdown anywhere outside it.
• [ ] Tests: production and preview labels; a pull title containing markup is escaped; the title is withheld from a viewer without access; the script registers the outside-pointerdown close. New test files named in GATE.
• [ ] Look: the pill on an app and on a preview, phone and desk.

Files: src/apps/proxy*.ts, the pill script, tests, scripts/gate.ts. Risk: the injected script must stay under the page's CSP; no inline handlers.