The forge's failure domains as data: src/kernel/domains.ts and docs/DOMAINS.md, each domain's words quoted from what the forge already says #1859

This adds the failure-domain map as data and as a one-page doc, with a test that proves each quoted phrase against the forge's own code. bun x tsc --noEmit is clean and bun test test/domains.test.ts test/vitals*.test.ts test/check-list.test.ts passes (34 tests). I did not run the forge's full check.

• Data: src/kernel/domains.ts exports DOMAINS, seven plain-data entries: compute, state, snapshots, edge, identity, credential and runner. Each has what breaks, says, minutes back, what the owner does, and drill (a name, or null with a one-sentence reason).
• Doc: docs/DOMAINS.md is the table, generated from the same row function, domainRow, that the test uses.
• Test: test/domains.test.ts is in GATE in scripts/gate.ts, in the same commit. It checks that the doc's rows equal the data and that the empty-says domains are the expected four. It also drives the real vitals() with a stubbed condition for each phrase:

- Disk is nearly full: comes from a free-disk threshold above 100%. - The restore drill failed at comes from a recorded red verdict. - wait behind one lane; the oldest since comes from two checks queued past the lane's 10-minute wait. - is stuck: no heartbeat for comes from a run whose last heartbeat is 4 minutes old.

• Phrases: says holds fragments of what vitals() emits today, not drafted text. I used fragments because the full sentences carry times and counts.
• No words yet: compute, edge, identity and the model credential have an empty says, and the doc says "nothing yet". The forge emits no text of its own for them: the edge and down messages come from the platform watchdog's status.json. I added no new words.
• Minutes back are estimates: I didn't measure them, and the doc says so.
• Drill names are proposals: kill-pod, lose-runner and expire-token are the names #1195 would build. Only restore-drill exists today, and the doc says that too. State, edge and identity have drill: null with a reason, since drilling them would lose writes or lock the owner out.

I left out the drills, the page and the endpoint, as the issue said. No dependencies were added.

Closes #1850