A red that main passes is the pulls' own: no sentinel issue a builder can only decline #8786

Each of these sentinel issues names a test that "passes on main's newest check": #8724, #8725, #8741 and #8747 (two builder runs each, all declined, all closed), and #8749, #8767, #8777 and #8783 (open now). Three or more pulls failed one test in an hour, so src/checks/shared_red.ts called it the lane's red. But the cause was each pull's own: a page, a tool or a row the pull added, or a main test written after the pull's base. TREE_GATES has been extended by hand for each such case (#7809, #8140, #7906, #8184). This replaces the hand list's growth with a rule.

Done looks like:

• [x] A shared test is the lane's only when main's newest check ran it and it failed there too, or when a re-run of a failing pull's check passes it (a flake). A test main passes that fails again on the same pull's re-run is the pull's: its builder gets the follow-up with the test named, as for any red of its own, and no shared card or sentinel issue is made.
• [x] The sentinel closes its open shared-red issues whose test the rule now calls the pulls' own, with a note saying why. Today that is #8749, #8767, #8777 and #8783 if they are still open.
• [x] TREE_GATES stays for the cases the rule cannot see. Each entry the rule now covers is removed, and the pull lists which.
• [x] Tests in test/shared-red.test.ts: three pulls fail a test main passes, and none is a shared red; three pulls fail a test main also fails, and it is shared; a flake that passes on re-run is still the lane's. test/sentinel-shared-settle.test.ts covers the sentinel closing its issue.

Files: src/checks/shared_red.ts, src/crew/sentinel.ts, test/shared-red.test.ts, test/sentinel-shared-settle.test.ts Risks: a real lane red (disk, load) wrongly charged to pulls. #2266's disk case must stay shared: main green but every re-run is random. Keep src/checks/disk_red.ts's path as it is.

Reviewed pull #8793 at its head: ticked A shared test is the lane's only when main's newest check ran it and it failed there too, or when a re-run of a failing pull's check passes it (a flake). A test main passes that fails again on the same pull's re-run is the pull's: its builder gets the follow-up with the test named, as for any red of its own, and no shared card or sentinel issue is made.; The sentinel closes its open shared-red issues whose test the rule now calls the pulls' own, with a note saying why. Today that is #8749, #8767, #8777 and #8783 if they are still open.; TREE_GATES stays for the cases the rule cannot see. Each entry the rule now covers is removed, and the pull lists which.; Tests in test/shared-red.test.ts: three pulls fail a test main passes, and none is a shared red; three pulls fail a test main also fails, and it is shared; a flake that passes on re-run is still the lane's. test/sentinel-shared-settle.test.ts covers the sentinel closing its issue..