A spawned child's first boot writes its direction issue once and prints one claim link for its owner #575

Replaces #422, which was parked twice: a preview that would not boot, and schema.ts and forge.json conflicts. This issue is the direction and claim half. The child's own keys and domain come next.

Acceptance:

• [ ] on first boot (no users yet), a child spawned by spawnForge (src/actions/spawn.ts) opens one direction issue from the spawner's words and assigns it to the planner. A second boot does not open another (a test boots twice; mind #383)
• [ ] it mints a claim link: 32 random bytes, stored only as a sha256, single-use, expiring in 24 h. The spawner sees it once in the Spawned result
• [ ] GET /claim/:token (and a POST, same-origin checked) makes the visitor the child's owner and admin, sets the session as an HttpOnly cookie, and burns the link. A used or expired link says so plainly
• [ ] the child answers /healthz and / in under 50 ms after boot (a test proves it)
• [ ] the migration is idempotent (see #558). Do not touch forge.json

Files: src/spawn/*, src/actions/spawn.ts, src/core/schema.ts, src/core/sessions.ts, src/web/pages/site.ts (or a new claim page), test/spawn-first-boot.test.ts. Fits: mason.