On a one-writer forge, the writer lets a proposed pull's exact head run, and that grant never counts as a review #2220

For the owner who is the only writer on their forge: a pull a child forge proposed upstream must get its check and preview without the owner faking a review. Replaces #2212. #2212 was declined twice because #2182 was not on main yet. It now is (release 0.7.147, 8bb4d2b4).

Where it stands on main: pullMayRun (src/core/pull_trust.ts:30) treats a pull as proposed when its head branch starts with child/ or pullProposalOf(db, pull.id) finds it. approveHere (src/actions/pulls.ts:708) returns not_foreign when originHeadRepo is null (line 719) and self_review for the minter (line 722). So nobody on a one-writer forge can let a proposal run.

Done looks like:

• [ ] A writer, including the one who minted the proposal token, can grant a proposed pull's exact head oid leave to run. Afterwards pullMayRun(db, repo, pull, thatOid) is true. Use one action in src/actions/pulls.ts that every door calls; extend approveHere for proposed pulls or add a sibling.
• [ ] The grant is recorded apart from reviews and does not count toward require_review or the merge gate. Test: in a require_review repo, the minter lets a proposal pull run, its check runs, and the pull is still not mergeable until someone else approves.
• [ ] A new head push waits for a new grant (test).
• [ ] A reader or a guest is refused (test).
• [ ] Every door offers it: the pull page (approveHereCard in src/web/pages/pull.ts), the terminal pull screen's A (src/tui/screens/pull.ts), the API route beside the existing approve-here route in src/http/api.ts, and MCP if approve-here is an MCP tool today.
• [ ] Tests live in test/proposal-token.test.ts or a new test/proposal-run.test.ts. bun x tsc --noEmit passes.

Risks: do not loosen pullMayRun for ordinary foreign pulls. Only the proposed branch of the function changes.

Closed: already done on main in 261d63d3 (pull #2223).