require_checks, green half: the merge waits for the fixed head's deploy and then goes, every time

Intent: half of #5204. After a fix is pushed, the merge must wait for the deploy of the new head, not the old one, and then succeed.

Done:

[ ] a new test/apps-require-checks-green.test.ts: with requireChecks on, a red pull gets a fixing push; before that head's deploy settles mergePull answers checks_required (the test holds the deploy until it has asserted this); once it settles green the merge succeeds
[ ] every wait is on the deploy record for the exact commitOid, never on a sleep or a "latest" read
[ ] bun test --rerun-each 20 test/apps-require-checks-green.test.ts passes, and the pull says so
[ ] the rest of the original test leaves test/apps.test.ts

Files: the new test, test/apps.test.ts. No source changes, unless the test finds a real race; then the pull names it.

require_checks, green half: the merge waits for the fixed head's deploy and then goes, every time #5278