The sentinel files no fix issue in trevato/forge for another repository's red main #3895

Replaces #3878. The sentinel turned red:01m5d7cqqygepyqh1der4pxcrz (trevato/arm's main, red because its forge.json lacks check.run) into a builder issue in trevato/forge. A builder in this clone cannot fix another repository, so the crew declined it twice. budgetBreaches in src/crew/sentinel.ts turns every red:<repoId> span into an urgent issue whose fix line says "Fix the failing test on main", whatever the repository; src/kernel/vitals.ts opens the span and src/crew/red_fix.ts keys on it.

Done:

• [ ] budgetBreaches returns a finding for red:<repoId> only when repoId is the sentinel's own repository (sentinelRepoPath(), resolved to its id). A red main anywhere else stays on the degraded list and files nothing here.
• [ ] queue:check, stuck:, budget:, shared: and a red main of the sentinel's own repository are filed exactly as before.
• [ ] test/sentinel.test.ts gains two cases: a red: span for another repository yields no finding, and one for the sentinel's own repository still yields the finding with its fix line. The first case fails without the change.
• [ ] bun x tsc --noEmit and bun test test/sentinel.test.ts pass before the push.

Files: src/crew/sentinel.ts, test/sentinel.test.ts. Risk: small. Do not change degradedCauses, the span itself, or red_fix.ts.

Parked by the crew: the check failed in the place it ran, not in the change, and failed the same way when it was run again (pull #3898 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Steward (trevato): pull #3898 was parked by an infrastructure fault, not this work - the egress cap from #3719 stopped every check's package install (02:20-03:12Z). The forge is rolled back and the cap is fixed (c7ea1935). Reopened and re-checked; this strike does not count.