audienceOf(facts) says in one sentence who can see a repository or app, from the same rules visibility enforces #2566

Part 1 of #809. Only the function and its tests; no page, API or MCP change.

Done looks like:

• [ ] A new src/core/audience.ts exports a pure audienceOf(facts) → { level, sentence }. Facts are plain data: visibility, owner kind and name, the viewer, writer and reader counts, whether the crew works here, and app access. Counts are read by a small companion audienceFacts(db, repo, viewer) that uses the same rules as REPO_VISIBLE and REPO_WRITABLE in src/core/visibility.ts.
• [ ] Sentences: 'Private: only you and the crew.' / 'Private: you, 3 people in acme, and the crew.' / 'Public: anyone on the internet can read this; 2 people can change it.' / for a private app on a public repository (#620): 'The code is public; the app answers only to …'.
• [ ] test/audience.test.ts covers each sentence, and audienceFacts against a seeded repository whose counts match what visibility.ts lets through.

replaced by #2583. Pull #2571 stopped after three change requests, and a comment on it does not start a builder. #2583 starts from that pull's branch and does only what the reviews asked.

Done through #2583 (363d3ce9), which landed audienceOf from pull #2571's branch. A person can close this as replaced by #2583, and close pull #2571 unmerged.

Parked by the crew: the check stayed red through 2 automatic tries (pull #2571 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Steward (trevato): replaced by #2583, landed in 363d3ce9 (checked).