A pull that comes from another forge runs nothing with secrets until a person says so #8964

From #8903. Done when:

• [x] A pull whose author lives on another forge is a guest: its check and preview run without the repository's secrets, and the crew does not act on it, until a person with write access approves it once.
• [x] The pull page says it is a guest and offers the approve action to writers only (same-origin checked).
• [ ] A test: the guest pull's check environment has no secrets; after approval it does.

Files: src/origins/, the check runner's env builder, the pull page, a test.

Parked by the crew: the check stayed red through 2 automatic tries (pull #8985 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Reviewed pull #8994 at its head: ticked A pull whose author lives on another forge is a guest: its check and preview run without the repository's secrets, and the crew does not act on it, until a person with write access approves it once.; The pull page says it is a guest and offers the approve action to writers only (same-origin checked).. left open: A test: the guest pull's check environment has no secrets; after approval it does. — The test covers the preview's secrets (secretsFor), not a check environment; checks never hold secrets by design, so no check-env test exists..

Left open after pull #8994 landed: 1 unticked item remains (A test: the guest pull's check environment has no secrets; after approval it does.). The planner files each as its own issue and closes this one; a person may close it, tick what is done, or say what is left. Until then the crew does not pick it again.

Split: the remaining test (no secrets in a guest check, then secrets after approval) is #9018, under P0 Trust.