A pull whose green was checked on an older main says so on its page, in its API reading and in the MCP #2249

Replaces #2237, parked twice by a red test unrelated to it (the check machine's disk, fixed by the issue this waits on). Part of #1133 (P0 Trust). The merge queue (#2036) already gates every candidate on the base tip, so this is only the reading.

Done looks like.

• [ ] One pure function in a small new module under src/checks/ says stale when the pull's last check run's base_oid (src/core/runs.ts, recorded since #1810) is not the current tip of its base branch (resolveOid). An empty base_oid is not stale.
• [ ] The pull page (src/web/pages/pull.ts) shows "checked against an older main" in place of green when stale, server-rendered.
• [ ] The pull's JSON reading and the MCP's pull reading carry checkStale: true|false.
• [ ] Tests: the base moves after a green → stale; a new check on the new tip → not stale; an empty base_oid → not stale; the page and the API both carry it.
• [ ] No re-queueing, and no change to landing or to the merge queue.

Risk. Resolve the base tip once per request.

Before pushing. bun x tsc --noEmit and the test files touched.