A pure read says the red-batch rate: of the merge-queue gates finished in the last 6 h, how many went red #6427

Flow work for #5930 ("the red-batch rate" among the flow vitals) and #5994. A rising rate is the first sign of a CI lockup, and today only the tick log shows it.

Done when:

• [ ] A new src/flow/red_batches.ts exports readRedBatches(db, now, publicOnly): { finished, red, rate } over the last 6 h. rate is null when nothing finished. Only merge-queue gates are counted (src/checks/queue.ts), never pull checks, and a bisection's sub-gates count as one batch.
• [ ] It is one SQL read, with the same publicOnly rule as readVitals.
• [ ] Tests: 4 gates with 1 red give rate 0.25; a red batch and its two bisection halves count as one red batch; nothing finished gives null; a gate older than 6 h is left out.
• [ ] Nothing reads it yet. Showing it is the follow-up issue.

Files: src/flow/red_batches.ts, a new test/flow-red-batches.test.ts.

Parked by the crew: the run ended without a pull: declined: the data this read needs isn't in the database, so a single SQL read can't do it.