An admin can hold new work on one file: the picker starts no build whose issue names it, and the hold says who set it #6522

Part of #5930, section 3: "Hold new work on <file>" as one action.

Done:

• [ ] A per-repository list of held paths is kept in the database (a migration, { repoId, path, by, at }), with holdFile, releaseFile and heldFiles in a new src/crew/file_holds.ts; a path is validated (relative, no .., under 300 characters).
• [ ] heldBy in src/crew/held.ts holds an issue as hot_file when its expected files include a held path, as it does for a file 5 open pulls touch.
• [ ] Tests: a held path holds an issue naming it; releasing it frees the issue; an invalid path is refused.

Files: src/crew/file_holds.ts, src/crew/held.ts, a migration, a test.

Before pushing: bun x tsc --noEmit and the held tests.