Forge a repository: one action on any repository spins up a fresh forge with it as the template #7834

This adds the Forge verb and the end-to-end test. It does not cover the crew checkbox or the "arrives signed in" part, which still wait on other issues.

What changed

• A Forge button now sits beside Fork on every repository page, for any signed-in person, the repository's owner included. It posts to POST /:owner/:name/forge, in the new src/web/pages/forge-it.ts, with the route added in src/http/server.ts.
• One press calls the existing spawn door with the repository as the new forge's app. The forge is named after the repository (Bakery_Shop becomes bakery-shop). The browser then goes straight to the child's /claim#<token> link with no code to copy, and the response is no-store.
• It reuses the door's checks (same-origin, admin scope, rate and child limits), so there is no new boundary to validate. A repository the person can't read is a 404.
• A second press makes no second forge and shows no second link. It goes to /forges, where a new link can be requested.
• test/forge-it.test.ts follows the whole path: the button shows only to a signed-in person, a stranger and a cross-origin press make nothing, and a press redirects to a claim link. It then claims that link on the booted child and checks the new admin is signed in and the repository's files are there. It also covers the name rule and the double press.
• docs/features/forge-it.md is the how-to. I added nothing to the README. gate, tsc, design-lint and the covering tests all pass.

What I left out

• Signed in on arrival: the person still picks a username and password on the claim form, and is signed in once they submit it. Arriving already signed in with no form is #2928.
• Crew picking up work: a hosted child still has no crew runner (#4416), so the "crew can pick up work on its own" box is not met. One test walking the whole path is only partly met for the same reason. It stops at the signed-in admin and does not show a crew taking work.
• Template choice: Forge uses the default template. Choosing one is #7534/#7535.
• Agents: there is no new MCP tool. The same action is spawn / POST /api/v1/forges with apps: ["owner/name"], and the doc says so.

To try it: sign in, open any repository you can read, press Forge, then finish the claim form on the new forge.

I did not run the full suite. scripts/fast.ts named 1082 test files for this diff, too many to run here, so I ran the 8 that cover the change.

Closes #7642

This adds the Forge verb and the end-to-end test. It does not cover the crew checkbox or the "arrives signed in" part, which still wait on other issues.

What changed

• A Forge button now sits beside Fork on every repository page, for any signed-in person, the repository's owner included. It posts to POST /:owner/:name/forge, in the new src/web/pages/forge-it.ts, with the route added in src/http/server.ts.
• One press calls the existing spawn door with the repository as the new forge's app. The forge is named after the repository (Bakery_Shop becomes bakery-shop). The browser then goes straight to the child's /claim#<token> link with no code to copy, and the response is no-store.
• It reuses the door's checks (same-origin, admin scope, rate and child limits), so there is no new boundary to validate. A repository the person can't read is a 404.
• A second press makes no second forge and shows no second link. It goes to /forges, where a new link can be requested.
• test/forge-it.test.ts follows the whole path: the button shows only to a signed-in person, a stranger and a cross-origin press make nothing, and a press redirects to a claim link. It then claims that link on the booted child and checks the new admin is signed in and the repository's files are there. It also covers the name rule and the double press.
• docs/features/forge-it.md is the how-to. I added nothing to the README. gate, tsc, design-lint and the covering tests all pass.

What I left out

• Signed in on arrival: the person still picks a username and password on the claim form, and is signed in once they submit it. Arriving already signed in with no form is #2928.
• Crew picking up work: a hosted child still has no crew runner (#4416), so the "crew can pick up work on its own" box is not met. One test walking the whole path is only partly met for the same reason. It stops at the signed-in admin and does not show a crew taking work.
• Template choice: Forge uses the default template. Choosing one is #7534/#7535.
• Agents: there is no new MCP tool. The same action is spawn / POST /api/v1/forges with apps: ["owner/name"], and the doc says so.

To try it: sign in, open any repository you can read, press Forge, then finish the claim form on the new forge.

I did not run the full suite. scripts/fast.ts named 1082 test files for this diff, too many to run here, so I ran the 8 that cover the change.

This round addresses all five review points; the only open question is the direction one, point 4. On the Forge it pull, I'm adding a terminal Forge it action, a README line, more tests, and a distinct button.

1. Terminal parity. The repository screen's : palette now has owner/name — Forge it for any signed-in person. It opens a confirm, then makes the forge through the same spawn door and shows the claim link once. If the forge already exists it says so and shows no link. The page and the terminal now share src/spawn/forge_it.ts for the name and the spawn call. The terminal screen is src/tui/screens/forge_it.ts, wired into workspace.ts, with test/tui-forge-it.test.ts covering it.

2. README. A Forge it paragraph now covers the button beside Fork, the terminal entry, the claim link, the double-press behaviour, and the agent route (spawn with apps). docs/features/forge-it.md is updated to match.

3. Tests. test/forge-it.test.ts now has four more cases.

• A signed-in user who can't read a private repo gets a 404 and no forge is created.
• A signed-out press on a public repo redirects to /signin and creates nothing.
• A non-owner who can read a public repo can forge it.
• A door refusal (409 name conflict) comes back as a "Not forged:" flash on the repository page, and the test checks that no <script follows it.

I did not add a test that a read-only user can't forge. Forging only requires being signed in as a person and able to read the repo, so a reader can forge, as the third case shows. If the intent was something stricter, that is a decision for you.

4. Direction. I can't confirm this is behind the pipeline issues. The Forge button and the terminal action are a small feature on the spawn door that already exists, and they add no pipeline code. The owner asked for it on #7642, and I noted that in the doc. If it should wait behind the pipeline issues, hold the merge.

5. Design. The button is now Forge it with the rocket icon at outline weight, next to Fork's fork icon at default weight, so the row still has one accent. design-lint reports nothing new.

gate, tsc and design-lint are clean. The covering tests pass: the forge-it, terminal, fork-bar, README-cap and new-forge suites. I ran those 62 tests only, not the whole suite.