A test pins leave-to-run: a grant names one head, a new push waits for a new grant, and a grant is never a review #6718

src/core/run_grant.ts and its reader in src/core/pull_trust.ts let a writer allow exactly one outsider head to execute here. Nothing calls grantRun or runGrantedAt in a test.

Done when test/run-grant.test.ts shows:

• [ ] After grantRun on head A, runGrantedAt answers for A, and the pull's trust says it may run on A.
• [ ] After a push to head B it may not run until B is granted.
• [ ] Granting A twice keeps one row, moves granted_at, and records the second granter.
• [ ] An empty oid is never granted.
• [ ] A grant does not count toward require_review or the merge gate: a granted head with no review still cannot be merged where review is required.

Files: test/run-grant.test.ts, src/core/run_grant.ts, src/core/pull_trust.ts