A preview whose head no writer approved stops at boot, and when a writer asks for changes on it #829

Closes #788. Follows #779 (the fork-pull gate).

What changed (src/apps/runtime.ts):

• At boot: a preview whose head the gate refuses (mayRun → pullMayRun) is torn down instead of coming back asleep. That catches one built before the gate, or one whose approval was withdrawn while the forge was down. Approving the head deploys it again.
• On a writer's changes request: a pull.reviewed with changes_requested re-asks the gate for the commit the preview serves (live, deploying or asleep). If it now refuses, the preview is torn down at once, not at its next sleep or restart. A queued check for that head is already cancelled when it starts, since #779 re-asks there too.
• Waking was already gated (#779). Writers' and the crew's previews are untouched.

Tests (test/fork-pull-approval.test.ts; the two new refusals failed before the change):

• At boot, a reader's preview with no standing approval is gone.
• A running reader's preview goes once the approving writer asks for changes.
• The wake test still holds: the approval is removed after the preview falls asleep, and waking takes it down.
• A writer's own preview comes back asleep after boot, untouched.

🤖 Generated with Claude Code