A trusted source's pull lands by true merge when its checks pass, with no review, credited in the changelog and the live stream #9015

From #8937. #9003 makes a trusted source's commits open a pull; this lands it.

Done when:

• [ ] A pull from a trusted, unexpired source that is green lands by true merge with no person's review, unless it touches what still waits for a person (secrets, permissions, walls, release machinery).
• [ ] Each landing appears on /changelog and in the home stream as it happens, credited to its author and source.
• [ ] A test: a trusted green pull lands by merge; a red one goes back; an expired source waits.

Files: the merge queue's admission for trusted pulls, src/web/pages/changelog.ts, the feed, a test.