A pull from someone who cannot write runs no check and no preview until a writer approves that exact head #777

Pillar: trust (umbrella #586). One run. Release and publish blocker.

Outcome. A pull from someone who cannot write the repository runs no code here — no check, no preview — until a person who can write approves that exact head. A new push is a new head and needs a new approval. Writers' and the crew's pulls behave as before.

Today. Checks (src/checks/service.ts, on pull.opened / pull.pushed / boot catch-up) and previews (src/apps/runtime.ts) start for any open pull, a reader's fork pull included.

Acceptance.

• [ ] One predicate decides whose pull may run: a pull whose branch lives in the repository, or a fork pull opened by a writer or the crew from their own fork, runs; anything else runs only at a head a person with write access approved. A crew approval does not count; an imported origin review does not count.
• [ ] Checks ask it when queued and again when they start; previews ask it in requestDeploy, so boot catch-up, redeploy and wake are covered.
• [ ] A writer's approval of the current head starts the check and the preview.
• [ ] The pull page says that checks and the preview wait for a writer's approval.
• [ ] Tests: a reader's fork pull queues no check and no preview deploy; approval of the head starts both; a new push needs a new approval; crew or self approval does not count; writers' and the crew's pulls run as before.

Done means reachable: pull page line, the review action as the approval, tests, a look.