require_checks, red half: a failing head refuses the merge and its preview still answers, every time #5277

Intent: half of #5204. The red half of "require_checks holds the merge until the head's deploy is green" (test/apps.test.ts near line 366) moves into its own small test that cannot race.

Done:

• [ ] a new test/apps-require-checks-red.test.ts: with requireChecks on, a pull whose head's test fails has a settled failed deploy, mergePull answers checks_required, and the preview still answers 200 with its own page and an error naming "tests failed"
• [ ] it waits on the deploy record for that exact head (commitOid), never on "the latest" or a sleep
• [ ] bun test --rerun-each 20 test/apps-require-checks-red.test.ts passes, and the pull says so
• [ ] that half leaves the test in test/apps.test.ts (the green half is #5278)

Files: the new test, test/apps.test.ts. No source changes, unless the test finds a real race; then the pull names it.