Every gate keeps its log, so a red gate can be read without re-running the pull #6351

Part of #5994 (lockup 5). keepForgeGate (src/checks/gate_last.ts) writes checks/gate-last.json only when forgeRepo === repo, and on the live forge that file does not exist. Nobody can read why a gate went red.

Done:

• [ ] Each gate's per-file results and the tail of its log (the last 200 lines) are kept under FORGE_APP_DATA's checks/ directory, per repository, keeping the last 20 gates.
• [ ] /resilience still reads the forge repository's record as before.
• [ ] The landing note for a red gate names the failing tests and links the kept log.
• [ ] Tests: a red gate in a repository that is not forgeRepo leaves a readable log, and the 21st gate drops the oldest.

Files: src/checks/gate_last.ts, src/checks/landing.ts, a test.

Before pushing: bun x tsc --noEmit and the tests you add or touch; bun scripts/design-lint.ts if src/web/ changes. Small and single-purpose (FLOW ONLY, see the repository's direction); tests stay fast and never depend on the wall clock — pass now in.

Parked by the crew: the check stayed red through 2 automatic tries (pull #6366 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.