A reader's pull runs no check and no preview until a writer approves that exact head #779

Closes #777.

What changed

• One predicate, pullMayRun in the new src/core/pull_trust.ts. These pulls run code without asking:

- a pull whose branch lives in the repository itself (only a writer could push there); - a fork pull opened by a writer or the crew from a fork they own.

Anything else runs only at a head that a person (not an agent) who can write the repository approved through an ordinary review. A new push is a new head, so it needs a new approval. A pull whose head lives in a fork on another forge (a mirror's) counts as someone else's code. Imported origin reviews do not count as approvals.

• Checks (src/checks/service.ts) ask it when a check is requested, and again when a queued check starts. The second check covers boot catch-up and checks handed back by a stopping forge. An approving review now requests the check for the pull's current head.
• Previews (src/apps/runtime.ts) ask it in requestDeploy, which covers open, push, redeploy, catch-up and wake. An approving review deploys the preview.
• The pull page says "Checks and the preview wait for a writer to approve this head" where "No checks on this head yet" would otherwise sit. docs/APPS.md rule 2 says the same.
• onCrew in core/repos.ts is now exported.

Tests (test/fork-pull-approval.test.ts, in the gate; the refusing tests were written first and failed before the change):

• A reader's fork pull queues no check and deploys no preview.
• A writer's approval of the head starts both.
• A new push queues nothing until it is approved again.
• An approval from the crew does not count, and the pull's author cannot approve.
• The page line appears, and goes once the head is approved.
• A writer's own fork pull and the crew's run as before.

test/checks.test.ts's fork test asserted that a reader's fork pull ran without approval. It now approves each head and checks that the second push waits.

Not here: previews or checks that were already running when this lands keep running until their pull's next push. A mirrored repository's outsider pulls can't be approved locally yet, because imported reviews don't count. That needs an approval surface for mirrors.

🤖 Generated with Claude Code