/events carries a run's new log lines as a run-scoped frame, only to people who can read the repo #2842

Split from #2835 (parked twice). This is the server half only. No client script changes, so src/web/client.ts and test/map.test.ts are not touched.

Done looks like:

• [ ] When appendRunLog (src/runs/log.ts) writes lines, the forge's /events stream sends one run.log frame to viewers who can read the run's repository. The frame holds { run, lines }, redacted the same way the log file is, and is capped at a fixed size per frame (say 64 lines or 16 KiB, then a truncated: true flag).
• [ ] Log frames are not history: they have no id and are never replayed on ?since=. A tab that opens late reads the log file the way it does today.
• [ ] Tests (a new test/events-run-log.test.ts): a reader receives the frame. A person who cannot read the repo, or is signed out, gets nothing from a private repo. A secret the redactor knows never appears in a frame. A reconnect with since replays no log frame.
• [ ] The per-run log streams that exist today still work unchanged. They are removed in the next two issues.

Files: src/runs/log.ts, the /events hub in src/http/server.ts (or the module it calls), the new test. Risk: the volume on a busy forge. Each frame is bounded, and sending is skipped when nobody is listening.