Run events tell a reader who cannot write no cost, turns or node #2964

The redaction is right, and it goes in the right place. eventForReader uses canSeeOwnerFacts, the same predicate runForViewer uses in src/http/api.ts. It is cached per repository and touches only run.*. I checked every outbox consumer: feed/items.ts already gates cost on ownerFacts, web/feeds.ts and thread.ts never forward run payloads, and the terminal's live() only triggers refreshes. So the events API and the two SSE streams are the whole surface, and this pull covers all three. Webhooks keeping the full payload matches the issue.

Fix this first: half of the new behaviour has no test. The pull redacts in four places in src/http/sse.ts: replay and live on the forge-wide /events stream, and replay and live on the per-repository stream. No test fails if any of them is reverted, and the description says so ("I didn't test the streams"). These are the doors a browser keeps open, and a later refactor of named or of sseStream would bring the leak back silently. Add tests to test/event-audience.test.ts that open the per-repository stream and /events as a stranger, with Last-Event-ID set so the replay path runs. They should also append a run.finished while connected so the live path runs. Assert that the frames carry runId and no costUsd/turns/placement/node, and that the owner's frames carry them.

Smaller:

• The owner half of the API test never checks placement, so dropping it for owners would pass.
• In viewerStream, named closes over redact, which is declared further down. It works only because named runs inside callbacks; declare redact next to meant, above named.
• The type check was not run here (the description says tsc could not write to tempdir). The forge's check covers it, but say so if it is still unrun.

I could not open the preview from the reviewer sandbox, so this verdict is from the diff and the code.

Approved. Run events now drop costUsd, turns, placement and node for anyone who fails canSeeOwnerFacts. That uses the same rule as the inbox's cost line (feed/items.ts), so the owner keeps all four fields.

I checked every place that sends event payloads to a client:

• Covered by this change: the events API (api.ts), the per-repository stream, and /events. Both streams are covered when replaying missed events and for live ones.
• Already safe: the Atom feed, the issue-thread timeline, the studio's tell, the inbox and the terminal's live refresh (tui/screens/common.ts, which only triggers a redraw) never pass these fields on.
• Webhooks: they still carry the full payload. They go to admins, as the pull says.

Redaction happens after audienceFilter, and only on a copy of the payload, so the event on the bus is never modified. The owner check is cached per connection, the same way visible caches repository visibility, so a writer whose access is revoked keeps seeing these fields until they reconnect. That matches the stream's existing rule.

The tests would fail without the change: the builder reverted the per-repository stream's redaction and saw them fail. They cover the API and both streams, replay and live, for a stranger, a signed-in non-writer (API) and the owner. The forge's check passed at 43cce38. There is no new UI, so the README and tty.ts have nothing to add.

I could not reach the preview or read the screenshots from my sandbox (network and file reads are denied), so this verdict rests on the code and the check.