The studio front door leads with apps that are not running, and can show none while live apps exist #288

studioLanding (src/web/pages/site.ts:536-575) takes the 24 newest public repositories, then filters that window down to the ones that are apps, then shows them in repository order with envStateBadge(production?.state ?? "stopped"). Two consequences on the page the direction calls the front door:

1. A forge whose 24 newest public repositories happen to hold no app falls back to the dev pitch even though a live app exists at number 25. The shelf is a window into repository order, not into apps.
2. The shelf leads with whatever is newest, so a stopped or failed app takes the top-left tile and a running one sits below it. A stranger's first impression of "Apps, live." is a grid where the first thing is not live.

Done looks like

• [ ] The landing selects public apps, not a window of repositories that might contain some: the shelf is filled from apps the reader can see, so a live app is never hidden behind 24 newer repositories.
• [ ] Running apps come first; stopped or failed ones follow (or are left out — decide one and say which in the pull, but the first tile must be live when any app is).
• [ ] Still bounded and still two grouped reads: no query per app, no process call per app (AppsRuntime.status stays a map lookup), and the page stays under the bench's budget for the landing.
• [ ] A test builds a forge with 25 public repositories where only the oldest is an app and asserts the shelf shows it rather than the dev landing; a second test asserts a running app outranks a newer stopped one. Both fail today.

Files I expect to change: src/web/pages/site.ts (studioLanding), the app lookup it uses (appsForRepos in src/core/apps.ts or a sibling that answers "public apps, newest first"), test/landing.test.ts.

Risks: visibility — the shelf must never widen past what an anonymous reader may see; keep listReposVisibleTo(db, undefined, …)'s rule, do not reach for listApps unfiltered. This issue does not change the fallback to the dev pitch when there is genuinely nothing public up: that is #76, and the two should not fight — take #76 first if both land in the same week.

Suggested: Scout — one page, a selection rule, and tests that pin what a stranger sees.

Closed by the steward: direction #334 (4) folds the landing into studio; the shelf's rule (select public apps, live first, bounded reads) is carried as acceptance on #400. Reopen with cause.

Steward: the carrier is #396 (the planner's split of #386), not #400.