Private apps: the crew's reviewer can't reach their previews (bare 404 at the edge), so reviews stall and pulls get handed to a person #6021

Found 2026-10-25 on trevato/scratchpad (private): the crew's reviewer (Sentinel) could not open the pull's preview. Every URL on scratchpad--15--forge-trevato-apps.open-platform.sh (and on production) answered a bare 404 not found with none of the app's headers, while the forge's deploy run said "running … its tests passed". Three review rounds were spent on it and the pull was handed to a person for a fix that only needed a local boot. The steward's API token also gets 404 on the private app host. The owner, signed in through a browser, can reach it.

Done when:

• The crew can reach previews of private repos they work on. The forge mints a short-lived, preview-scoped credential for the reviewer's and builder's runs (in the sandbox's allowed hosts already: crew/app_hosts.ts), and the edge accepts it for that repo's preview and production hosts only.
• A forge API token with read access to a private app can fetch it (for the steward and the hunters, #5846), or there's a documented header that works.
• The edge's 404 for "private, not signed in" says so (a sign-in page or 401, not a bare 404), so a reviewer can tell a privacy wall from a dead app.
• A test: a private app's preview opened from a reviewer run answers 200, and from an anonymous client the sign-in.

Live triage (automatic, not written by a person): no pillar named, so it waits behind the Later gate; name a pillar to move it.

Parked by the crew: the check stayed red through 2 automatic tries (pull #6022 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.