Design: a forge births a forge — new org, instance, chosen apps, crew, domain, keys — and the child follows its parent; '+ New forge' #428

The design for #389 is now eight linked issues, plus a one-page summary in docs/SPAWN.md. No code changed and I ran no tests; only the doc is pushed.

The issues, in the order they wait for each other:

• #420, spawn plan: one validated, dry-runnable value for what a child is made of. It carries the chosen apps as repos with history, crew briefs and subscription names. It never carries secrets, tokens, SSH keys, the run ledger, issues or user accounts. It waits for #383.
• #427, placement seam: hosted inside the parent today, with limits on children per forge and on nesting depth. It waits for #420.
• #421, spawn action: creates the child org and instance and copies the apps and briefs. It waits for #420 and #427.
• #422, first boot: the child gets its direction issue, its own tokens and keys, a domain, and a single-use claim link for its owner. It waits for #421.
• #423, cross-forge following: the child follows its parent over HTTPS git with a read-only upstream token, because hosted children have no SSH. It waits for #422.
• #424, propose upstream: the child opens a pull on the parent through a proposal-only token, limited to branches under child/<name>/. It waits for #423.
• #425, family tree across forges: children report to the parent with signed heartbeats carrying counts and version only, and the parent never reaches in uninvited. It waits for #423.
• #426, '+ New forge' in the studio: a form that works without JavaScript, owner-only, showing the plan before spawning. It waits for #421, #422 and #339.

Left out on purpose:

• External bodies: Cloudflare, Fly and metal placement get their own issue once spike #339 decides. #427 covers only the seam and the hosted placement.
• Custom domains: the child gets a subdomain of the parent's. Custom domains are a later step.
• Parent-to-child pushes: the parent never pushes to a child. Child-to-parent flow is by proposal only.

To check: I first linked #427 after #421 and then reversed it, since spawn needs the seam first. The old acceptance line about #339 is still in #427's description because my edit was rejected, so I left a comment there saying to ignore it. Read docs/SPAWN.md for the table, then GET /api/v1/repos/trevato/forge/map to see what is ready.

🤖 Generated with Claude Code

Closes #389