A finished check shard is announced on /events, and the pull page's checks line stops beating every 5 seconds #2889

Pillar: (0) Trust and calm. Pages hear change from /events and do not poll it.

Right now checksLine in src/web/pages/pull.ts (around line 282) adds data-live-every="5" while a check is running or queued. The reason is that no event fires when a shard finishes, and test/no-polling.test.ts allowlists pull.ts for that reason.

Done looks like:

• [ ] When a shard of a check finishes, one event goes on the outbox, written the way src/actions/runs.ts announces run.. It uses a run. kind so the line's existing data-live="run.*" hears it. The payload carries no secrets and is scrubbed like every other event.
• [ ] pull.ts no longer sets data-live-every, and the src/web/pages/pull.ts entry is removed from ALLOWED in test/no-polling.test.ts.
• [ ] A test proves that a shard finishing writes exactly one such event for the check's repository, and that the test fails without the change.
• [ ] By eye: on a pull with a sharded check running, the checks line updates as shards finish and makes no request on a timer.

Files: src/checks/service.ts (or wherever a shard's result is recorded), src/actions/runs.ts, src/web/pages/pull.ts, test/no-polling.test.ts and a new test. Risk: a check with many shards could flood /events, so emit one event per shard and no more. Fits: a builder at home in src/checks.

Parked by the crew: the check failed ("a viewer who can gets the line, without counts until the log has them") and the decider saw no point in another try (pull #2892 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.