The tell-me inbox card lists the parent's new commits, so the owner can decide without leaving the inbox #2644

The tell-me card (src/spawn/upstream.ts) says "Your parent forge has N new commits" and nothing about what they are.

Done looks like:

• [ ] The card's body lists up to 10 of the new commits, newest first: short sha, the first line of the subject cut at 100 characters, and the date. It reads them with git log over refs/upstream/<branch> not in the fork's main, with fixed arguments and no user text, and says "and N more" beyond 10.
• [ ] Subjects are the parent's text: escaped wherever the issue body renders (markdown is already escaped; a test proves a subject with <script> and ](javascript: renders inert).
• [ ] Still exactly one card per parent tip; a failure to read the log still sends the card without the list.
• [ ] Tests with two local bare repositories: 3 commits are listed in order, 12 commits show 10 and "and 2 more", and a hostile subject is inert.
• [ ] Run bun x tsc --noEmit and the upstream tests.