`ssh <app>@<forge> pulls` prints the app's open pulls a viewer may see, newest first, with each head's check word #6109

Replaces #6072, whose pull #6078 went three review rounds because the module was not reachable from anything. This issue covers the module and the one door a test can prove now: the terminal. The /__forge/ door list is #6073. It cannot be judged on a preview anyway, because an app host's /__forge/ is served by the host forge.

Start from the branch of pull #6078 (scout/6072-a-bounded-read-lists-an-app-s-open-pulls). It already holds most of this.

Done when:

• [ ] src/apps/door_pulls.ts exports openPulls(db, repo, viewer, limit = 5). In one indexed query it returns {number, title, headOid, run} for open pulls, newest first. A viewer who cannot read the repository gets []. A sealed pull is returned only to its author, a writer or an admin. A suspended account counts as a guest. The SQL is an exported constant, and a test runs EXPLAIN QUERY PLAN on that same constant and fails on a SCAN of run, pull or issue.
• [ ] An exec of pulls on an app's login (ssh <app>@<forge> pulls) prints one plain line per pull: #n title · <check word>, using the existing check-word function from #6071. It needs no pty and goes through the same gate as the app's terminal.
• [ ] Tests drive forgeSshSession with a fake session:

- [ ] Setup: 7 open pulls plus 1 sealed. - [ ] A guest sees the 5 newest unsealed pulls. - [ ] The sealed pull's author also sees the sealed pull. - [ ] A named user who cannot read a private repository gets no app named … and exit 1. - [ ] A title holding control characters prints them stripped.

• [ ] The README says in one line how to run it, printing FORGE_APP_SSH verbatim where it names the command.
• [ ] When this lands, pull #6078 is closed.

Files: src/apps/door_pulls.ts, src/apps/tty_pulls.ts, src/tui/ssh.ts, test/door-pulls.test.ts, test/ssh-app.test.ts, README.md. Risk: src/tui/ssh.ts is also changed by the ssh <forge> tell issue. Whichever lands second rebases; keep the exec dispatch a small table so the two do not collide.