The forge's admin hears once of a domain drill that is red, stale or never run, with the exact command to run it #5368

For: when the sentinel stops filing drill causes as crew work, the person who can run the drill is the one told. Today drillLines in src/crew/notify.ts tells the admin about the restore drill only, not the domain drills that domainDrillNeeds (src/kernel/domain_drill.ts) raises.

Done:

• [ ] domainDrillLines sits beside drillLines in src/crew/notify.ts and is wired into the same notification set. For an admin, it gives one line per need from domainDrillNeeds. The id is the need's cause plus its since, so a repeat tick is not news, and a newer need (a later red) is. The line is the need's sentence, which already names the exact bun scripts/drills/run.ts … --forge … command.
• [ ] Only an admin who is a person hears it (the same guard as drillLines).
• [ ] A test in test/notify-causes.test.ts covers three cases: an admin gets the drill:never line naming every command; a second tick with the same need sends nothing; a non-admin gets nothing. Each fails without the change.

Files: src/crew/notify.ts, test/notify-causes.test.ts. Risk: reuse domainDrillNeeds as vitals calls it; do not compute the needs a second way.