A preview's pill says when its pull has merged or closed, and when the preview runs an older commit than the pull's newest push #9111

Intent: someone looking at a preview knows whether what they see is the pull as it stands now, not only which pull it is.

Today pillWhere in src/apps/proxy.ts (~line 450) gives the pill app, env, pull and, for a reader, title. The pill (src/apps/toolbar.ts ~line 78) draws "Preview of pull #N" whether the pull is open, merged or closed, and whether the preview runs the pull's head or a push from an hour ago. The runtime knows the commit it runs (state.live.commitOid in src/apps/runtime.ts), and the pull knows its head.

Done when:

• [x] PillWhere gains, for a reader of the pull only (the same gate as title), state: "open" | "merged" | "closed" and behind: boolean. behind is true when the live commit is not the pull's head commit. While a newer commit is deploying, the pill says so rather than saying behind.
• [ ] The pill draws one plain line under "Preview of pull #N": "Merged: this preview shows the pull as it landed", "Closed without landing", "A newer push is deploying", or "Shows an older push than the pull's newest". An open, up-to-date preview draws nothing extra. The words live with the pill's other words, not inline.
• [x] A signed-out viewer, or one who may not read the repository, gets none of these fields, as today with title.
• [x] Tests: through the proxy, an open pull whose preview runs its head gets no extra line; a merged pull's preview gets state: "merged"; a preview whose live commit differs from the pull's head gets behind: true; an anonymous viewer gets neither field. Each fails on main.
• [x] Rewriting the page stays inside its Server-Timing rewrite phase, with no git call on the request path: read the head from the pull row or the ref the forge already holds.

Files: src/apps/proxy.ts (pillWhere), src/apps/toolbar.ts (PillWhere, the line), a test under test/ (apps pill where, alongside test/apps-pill-where.test.ts). Risks: pages that carry a proof are private, no-store, but an anonymous page may be cached, so the new fields must never reach a page anyone else might be served. The pill script is content-addressed, so changing it changes its hash; keep test/apps-toolbar-asset.test.ts green. Fits: a builder (torque/scout).

Reviewed pull #9116 at its head: ticked PillWhere gains, for a reader of the pull only (the same gate as title), state: "open" | "merged" | "closed" and behind: boolean. behind is true when the live commit is not the pull's head commit. While a newer commit is deploying, the pill says so rather than saying behind.; A signed-out viewer, or one who may not read the repository, gets none of these fields, as today with title.; Tests: through the proxy, an open pull whose preview runs its head gets no extra line; a merged pull's preview gets state: "merged"; a preview whose live commit differs from the pull's head gets behind: true; an anonymous viewer gets neither field. Each fails on main.; Rewriting the page stays inside its Server-Timing rewrite phase, with no git call on the request path: read the head from the pull row or the ref the forge already holds..

Left open after pull #9116 landed: 1 unticked item remains (The pill draws one plain line under "Preview of pull #N": "Merged: this preview shows the pull as it landed", "Closed without landing", "A newer push is deploying", or "Shows an older push than the pull's newest". An open, up-to-date preview draws nothing extra. The words live with the pill's other words, not inline.). The planner files each as its own issue and closes this one; a person may close it, tick what is done, or say what is left. Until then the crew does not pick it again.