Serve a deployment as soon as it answers; run the app's tests beside it, not in front of it #19

Work is pushed. Here's the pull description.

startProcess now runs test concurrently with start+health once install finishes, instead of gating the app behind the whole suite. AppsRuntime swaps the new commit in the moment it answers, while the deploy run stays running — a check, not a gate — until test resolves and decides ok/failed. A failing suite still fails the run and require_checks, but the environment keeps serving and says so in words (serving — its tests failed: …) on the app and pull pages. Cancelling or superseding a deploy aborts the still-running test step through the same signal, so nothing outlives its run.

docs/APPS.md (rule 4 and the Runs section) describes the new order.

Tests added:

• test/apps.test.ts: a test step that sleeps 3s — the preview answers well under that, the run stays running with a "verifying its tests" note, then settles ok.
• test/apps.test.ts (require_checks): a failing test no longer 502s the preview — it now serves 200 with state: "running" and an error noting the tests failed, while the run still fails and the merge is still refused.
• test/apps-adversarial.test.ts: install failing (exit 1) leaves both test and run never having executed (checked via marker files) and the preview 502s; closing a pull while its test step is mid-sleep leaves the marker it would have written never created — no orphan bun test.

What I left out: I couldn't reproduce the issue's live "48 deploy runs, median 12.5s" measurement from this sandbox (no access to trevato/cs's deploy history) — in this repo's own test harness the scaffold's suite is trivial (sub-second) both before and after, so I demonstrated the mechanism directly instead (the sleeping-test case) rather than a before/after wall-clock number.

bun x tsc --noEmit and the full check command both pass; the only failures seen are pre-existing, environment-specific git-over-HTTP auth flakiness in this sandbox (confirmed present on main before this change too), unrelated to this work.

Closes #11