A public app's pages carry a Link to the forge's manifest for its repository, so an agent landing on the app finds what it can do #7861

Intent: an agent that reaches an app, not the forge, still finds the role-aware manifest without being taught. The forge's own pages already carry <link rel="alternate" type="application/json" href="/api/v1/here?path=…">, and the app proxy already adds a rel="help" Link to /__forge/report.

Done when:

• [ ] Where src/apps/proxy.ts appends REPORT_LINK to an HTML answer, it also appends <{forgeUrl}/api/v1/here?path=%2F{owner}%2F{name}>; rel="alternate"; type="application/json". The URL is built with new URL on runtime.options.forgeUrl, and the owner and name are percent-encoded.
• [ ] It is added under the same rule as the report Link: a public app whose repository the public may read. A private app, a nested target and a non-HTML answer get neither Link.
• [ ] The app's own link headers are kept, and the new one is appended, never set.
• [ ] test/report-discovery.test.ts gains cases for a public app's HTML page (both Links present, and the manifest URL answers 200 with here.kind: "repository"), a private app (neither) and a JSON answer (neither). Each fails without the change.

Files: src/apps/proxy.ts, test/report-discovery.test.ts Risks: #7853 and #7855 edit the door handler in the same file, far from this. Keep the change at the REPORT_LINK site.