One forge follow-ups: Runs only for who may read them; the palette lists apps first; stale mode comments go #929

Follow-ups to #906 (one forge), from product-reviewer-2's verdict and the lead's call.

1. Runs only for who may read them. The repository's Runs tab and both Runs palette entries now follow mayReadRuns. A reader of a private app on a public repository no longer gets a door that leads nowhere. A repository only browsed from elsewhere (no local row) has no runs here, so it gets no tab either.
2. The palette lists apps first (lead's decision). listReposVisibleTo gains an appsFirst option: repositories that run an app come first, each half newest first. The palette uses it, and the cap is unchanged at 30. Rows are grouped as "Apps" and then "Repositories". Which rows are apps is found in one query (appsForRepos), not one per row.
3. Stale comments. The last ?mode=dev and dev-mode comments are gone (tell.ts ×2, change.ts, search.ts, chrome.ts, and the web-ui palette test, which now reads /).

Removed: nothing user-facing beyond the Runs door for readers who cannot read runs.

Tests:

• private-app "…who get no Runs tab (#906)…" checks a reader and an anonymous visitor (no /runs link in the tab strip or palette) and the writer (has it). It fails without the change.
• studio "the palette lists apps first, then the other repositories (#906)" uses a plain repository made after the app.
• tsc is clean; private-app, studio, studio-words, web-ui, palette, web-origins, web and the five cross files give 377 pass.

Hot files: src/web/layout.ts (plus src/core/repos.ts, adding an optional listReposVisibleTo option; existing callers are unchanged).

🤖 Generated with Claude Code