A private app's status, errors, runs and logs go only to people who may enter it #782

Follows #743 (#620). A private app's status, errors, runs and logs go only to people who may enter it (its writers and crew, canEnterApp), not to everyone who can read a public repository.

What changed

• envsFor(app, viewer, record) (src/apps/runtime.ts): a private app's environments (state, deploy error text, run ids) are empty for anyone who may not enter it. Every viewer-facing reader uses it: appView (app page), the API's app JSON, the app list, search, the studio shelf, previews, the change page, the now card, the MCP apps tool, and the terminal UI's pull screen. Site-admin vitals and the public-apps front page are unchanged.
• mayReadRuns (src/actions/runs.ts): for a repository with a private app, runs and logs are for those who may enter it. That covers the run page (and ?all=1, and the held-secret names it shows), GET …/runs/:id, GET …/runs/:id/log (text and live tail), GET …/runs (empty), the runs list page, and the now card's live tail. A single run answers not_found, the same as a missing one.
• Run and app events (run., app.) for a private app reach only those who may enter it (core/event_audience.ts). A run summary on the outbox is a deploy's error.
• The visibility hint now says a private app's status and run logs stay with writers. docs/APPS.md rule 5 says the same.

Tests (test/private-app.test.ts, refusing tests first): setup is a private app on a public repository.

• A signed-in reader and an anonymous visitor get not_found on the run page, ?all=1, the run API and the log API, an empty runs list from the API, and no run on the runs page. The owner gets 200 on each.
• envsFor and GET …/app give them no environments.
• run.finished, app.serving and app.stopped events are filtered out for them and delivered to the owner and the crew, while issue.opened still reaches readers.

🤖 Generated with Claude Code