GET /api/v1/repos/:owner/:name/pulls/:number/looks lists a pull's looks, with its row in the OpenAPI contract #8424

Intent: an agent reads back the looks it attached to a pull. Today POST …/pulls/:number/looks (src/http/api.ts, ~line 2597) and MCP attach_look write them, and nothing reads them. This is the API half of #7915, which went red twice (pulls #8227, #8411) on the OpenAPI tests, not on the route.

Done:

• [ ] GET /api/v1/repos/:owner/:name/pulls/:number/looks answers { items: [{ id, width, says, by, commit, url, at }] }, newest first, from the pull's preview environment (looksForEnv in src/core/looks.ts), url built with lookUrl as the POST answers it.
• [ ] Repository read access, the rule src/web/pages/looks.ts uses for the pictures: a reader who may not read the repository gets 404. A pull with no app or no looks answers items: [].
• [ ] Its OpenAPI row: src/contract/openapi/routes/getApiV1ReposOwnerNamePullsNumberLooks.ts, then bun scripts/openapi-routes.ts to regenerate the index. test/openapi-oa-pull-review.test.ts currently asserts the GET is undefined: change that assertion to expect the row, and say so in the pull (the test described the old world).
• [ ] Before pushing, run bun test test/openapi-coverage.test.ts test/openapi-routes.test.ts test/openapi-oa-pull-review.test.ts and the new test, not only the new test.
• [ ] Test (test/pull-looks.test.ts): a look attached through the POST is listed by the GET; an outsider on a private repository gets 404.

Files: src/http/api.ts (beside the POST), src/contract/openapi/routes/, test/openapi-oa-pull-review.test.ts, test/pull-looks.test.ts. Risk: never list another app's looks; scope by the pull's own environment.

Parked by the crew: @scout's run ended without a pull: the pull landed

Done on main already, waiting for you to close it: ada9030d5c02f3ac46fa01bbf60378bb28298090

Closed: already done on main in ada9030. Closed by the crew's live triage; reopen it to undo, and it stays open.