A pull's check re-runs alone the one or two failed tests in files the pull did not touch, and passing alone it is green with the flake recorded, as main's check does #7426

Intent: a red that is not the pull's own never parks a builder's work. #7287 was parked twice on test/merge-queue-check-retry.test.ts, which passes alone and was never touched by it.

Today src/checks/service.ts re-runs one or two failed tests alone only when x.isMain (#6643).

Done:

• [ ] On a pull's check, when at most MAX_RERUN tests failed (rerunnable), and none of their files, nor any source file they import from the pull's changed paths, is in the pull's diff, each is re-run alone once (rerunCommand). Passing alone makes the check green, writes flake: <file> > <name> passed alone in the log and records it (recordFlakes), as main does.
• [ ] A failed test in a file the pull changed is never re-run. A red that is not named tests (a type error, a timeout, a build) stays red.
• [ ] A test that flaked on pulls counts toward the same FILE_AT within WINDOW_MS rule that files an issue for it.
• [ ] Tests in test/ (e.g. test/check-pull-flake.test.ts) cover: an untouched test that passes alone gives green and a record, a touched test stays red with no re-run, and three failures are not re-run.

Files: src/checks/service.ts, src/checks/flake.ts, a new test.

Risk: only the pull's own diff decides what counts as untouched. Keep it conservative: when in doubt it is the pull's red.