GET a repository's pulls reads each pull's mergeability from a cache keyed by base and head: `merge` under 20 ms for 130 open pulls #6197

Measured 2026-10-26: GET /api/v1/repos/trevato/forge/pulls?state=open takes 405 ms, and merge;dur=395.2 is nearly all of it. pullMergeStates (src/http/api.ts, near the merge phase) computes a merge for every pull on every request.

Done when:

• [ ] A pull's mergeable/conflicts answer is cached by (base oid, head oid). A push to either side misses the cache, and nothing else does.
• [ ] A test with 100 open pulls asserts the second request's merge phase is under 20 ms, and that a push to one pull's head changes only that pull's answer.
• [ ] The answer's shape is unchanged.

Files: src/http/api.ts, the module behind pullMergeStates, a test. Risk: a stale "mergeable: true" would mislead a merge. The key must include both oids, and the base oid must be read fresh.

Parked by the steward, 2026-10-26 (owner: "get us unclogged now then resume everything else"). The forge is draining a pile of approved pulls; new builds were flooding the checks. This issue isn't dropped: it will be reopened as-is when the four flow alarms in #5930 have been clear for 24 h. The list is kept in the steward's parked-2026-10-26 file.