`ssh <app>@<forge> pulls` prints the app's open pulls a viewer may see, newest first, with each head's check word #6116

ssh <app>@<forge> pulls now prints the app's open pulls as #n title · green|red|running|none, newest five first. The new tests, the type check and the related ssh and account suites pass. The tests that drive the real OpenSSH client were skipped here because /usr/bin/ssh is not installed.

The branch of #6078 wasn't visible to me, so I built this on main. Close #6078 when this lands. I did not close it.

• Query: openPulls(db, repo, viewer, limit = 5) in src/apps/door_pulls.ts does one indexed read, OPEN_PULLS_SQL, and returns {number, title, headOid, run}. A test runs EXPLAIN QUERY PLAN on that same constant and fails on a SCAN of run, pull or issue.
• Who sees what:

- A viewer who cannot read the repository gets []. - A sealed pull goes only to its author, a writer, the crew or an admin. - A suspended account counts as a guest.

• Exec: src/apps/tty_pulls.ts prints the lines using the existing checkWord. It needs no pty and strips control characters from titles. The gate is now a shared appGate in src/apps/tty.ts, which the app terminal also uses, so a refusal is the same sentence, such as no app named secret with exit 1.
• Dispatch: src/tui/ssh.ts keeps a small appExecs table of command word to handler, so the tell issue can add a row and rebase cleanly. Any other exec on an app login still goes to git and gets the "only git is available" message.
• Tests: test/door-pulls.test.ts drives forgeSshSession with a fake session. It has 7 open pulls plus 1 sealed, and covers every case in the issue.
• README: one line under "Live in the terminal" says how to run it and names FORGE_APP_SSH as the exact command.

I left out the /__forge/ door list (#6073), as the issue says. I also put the fake-session tests in door-pulls.test.ts rather than ssh-app.test.ts, because that file needs the real OpenSSH client and would skip them.

Closes #6109

ssh <app>@<forge> pulls now prints the app's open pulls as #n title · green|red|running|none, newest five first. The new tests, the type check and the related ssh and account suites pass. The tests that drive the real OpenSSH client were skipped here because /usr/bin/ssh is not installed.

The branch of #6078 wasn't visible to me, so I built this on main. Close #6078 when this lands. I did not close it.

• Query: openPulls(db, repo, viewer, limit = 5) in src/apps/door_pulls.ts does one indexed read, OPEN_PULLS_SQL, and returns {number, title, headOid, run}. A test runs EXPLAIN QUERY PLAN on that same constant and fails on a SCAN of run, pull or issue.
• Who sees what:

- A viewer who cannot read the repository gets []. - A sealed pull goes only to its author, a writer, the crew or an admin. - A suspended account counts as a guest.

• Exec: src/apps/tty_pulls.ts prints the lines using the existing checkWord. It needs no pty and strips control characters from titles. The gate is now a shared appGate in src/apps/tty.ts, which the app terminal also uses, so a refusal is the same sentence, such as no app named secret with exit 1.
• Dispatch: src/tui/ssh.ts keeps a small appExecs table of command word to handler, so the tell issue can add a row and rebase cleanly. Any other exec on an app login still goes to git and gets the "only git is available" message.
• Tests: test/door-pulls.test.ts drives forgeSshSession with a fake session. It has 7 open pulls plus 1 sealed, and covers every case in the issue.
• README: one line under "Live in the terminal" says how to run it and names FORGE_APP_SSH as the exact command.

I left out the /__forge/ door list (#6073), as the issue says. I also put the fake-session tests in door-pulls.test.ts rather than ssh-app.test.ts, because that file needs the real OpenSSH client and would skip them.