Spawn action: create the child org and instance, copy the chosen apps and crew briefs into it #421

Part of #389.

Intent: src/actions/spawn.ts takes a SpawnPlan and makes the child: a new org, a new forge instance in the hosted body (see the placement issue), the chosen apps as repositories with history, crew briefs, and one parent record pointing back (upstream URL, nothing secret). One action, one event (forge.spawned), same-origin checked, owner-only.

Acceptance:

• [ ] refuses a plan that fails validation again at the action (never trust the dry-run)
• [ ] idempotent on retry: a half-made child is resumed or cleaned, never duplicated
• [ ] the copy writes only under the child's own FORGE_APP_DATA
• [ ] tests: apps arrive with history; briefs arrive; no secret arrives; a second call does not duplicate