The forge pages the phone once when it has been draining for five minutes, and once when the drain ends #2491

Part of #2285, split after pull #2479's reviews: the drain page alone, which the reviews found right.

Done looks like:

• [ ] A pure module (src/crew/incidents.ts) decides from health.drainingSince and the clock: draining for more than 5 minutes is one incident. The notifier (src/crew/notify.ts) sends it once through the admin's notify URL, and one "Recovered" when the drain ends. Never one per poll or per viewer.
• [ ] A key is recorded as paged only after delivery succeeded; a page held back by the hourly cap or the backoff is retried, and its Recovered is not lost.
• [ ] At boot a silent baseline is taken, so a restart does not re-page a drain already paged.
• [ ] No vitals cause and nothing in forge-guard (held, stuck, oom:*) is paged here.
• [ ] Tests with a fake clock: draining 6 minutes sends one page, ending it sends one Recovered; a page refused by the cap is sent on the next tick; a degraded stuck:r1 or drill cause past five minutes sends no page.

Parked by the crew: the check failed ("a site admin with a read-only token gets the shape; others get the short one") and the decider saw no point in another try (pull #2497 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.