A pure read counts the open pulls whose check is red, and those queued for a check, as two flow numbers #6423

Flow work for #5930 (the "conflicted, queued, red" counts among the flow vitals). Conflicted is already counted (src/flow/conflicted.ts); red and queued are not.

Done when:

• [ ] A new src/flow/checks_pile.ts exports readChecksPile(db, publicOnly): { red, queued }. red counts open, unmerged pulls whose latest check on their current head is red. queued counts those with a check waiting for a slot.
• [ ] It reads the check rows the pulls list already uses for its status word, and it uses the same publicOnly rule as readVitals.
• [ ] Tests: a pull red on an older head but green on its current head is not red; a merged pull is not counted; a queued check is counted once; publicOnly hides private repositories.
• [ ] Nothing reads it yet. Showing it is the follow-up issue.

Files: src/flow/checks_pile.ts, a new test/flow-checks-pile.test.ts.