Say a pull request nobody checks as a delivery held, owned by mesh-delivery (hq issue 347)

The confirmation review asked for the delivery domain's own vocabulary
instead of a provider standing. A gitea health check would need a `tools`
list (turning gitea's tools into seat verbs), a check of another kind
beside it, and would hold the forge's own deliveries at the first-node
gate; so the delivery's owner says it, with the word it already has.

- gitea_open_pulls (gitea): every open pull request from the forge itself,
  with what its base requires and the statuses its head has.
- mesh-delivery asks it every five minutes and keeps its own first-seen
  time per head (the forge's update time moves on every comment). A head
  on a base requiring mesh/merge-gate OR mesh/repo-check (hq requires only
  the second) with neither for ten minutes is a `stalled` line in state
  `unannounced`, which the controller raises as delivery.<id>.stalled (D14);
  H2 has nothing to close. Once announced it is a delivery of its own.
- The gitea-side watcher and its provider standing are gone.

modules/mesh-delivery/module.json

@@ -44,7 +44,8 @@
     "gitea.gitea_delivery_view",
     "gitea.gitea_commit_status",
     "gitea.gitea_commit_statuses",
-    "gitea.gitea_contains"
+    "gitea.gitea_contains",
+    "gitea.gitea_open_pulls"
   ],
   "state": [
     "deliveries",