Cover a held merge only when the forge says a later delivered merge contains it (review of #150)

Merge order on a protected trunk was the whole proof; the review asked for ancestry. The gitea module
gains gitea_contains, a read-only compare of two commits (total_commits 0 is contained), and mesh-delivery
asks it once per pair, off the lock like its plan ask, keeping the answer on the delivery. A forge that
cannot say leaves the merge held, not covered. Merge order stays the cheap first filter.

A later delivery now carries a module only when its own check passed (so a merge held without a passing
check is closed only by one that passed), its walk is of its own merge commit on the same trunk, and its
steps say the module reached every machine running it, not one. The words say what is known: a later
merge that contains it was delivered.

modules/gitea/test/checks.test.ts

@@ -46,3 +46,20 @@ test("no rule requires nothing; a rule that cannot be read says nothing, never y
   assert.equal(unread.mergeable, null);
   assert.match(unread.says, /could not be read/);
 });
+
+// novox/hq ADR 0270: a held delivery is covered only when a later delivered merge contains it.
+test("a commit is contained in another when the compare finds nothing on it the other lacks", async () => {
+  const { containedFrom, isCommit } = await import("../checks.ts");
+  for (const [compare, contains, ahead] of [
+    [{ total_commits: 0, commits: [] }, true, 0],
+    [{ total_commits: 3, commits: [{}, {}, {}] }, false, 3],
+  ] as const) {
+    assert.deepEqual(containedFrom(compare), { contains, ahead });
+  }
+  for (const bad of [{}, { total_commits: "0" }, { total_commits: -1 }, null]) {
+    assert.throws(() => containedFrom(bad), /total_commits/);
+  }
+  assert.equal(isCommit("6aabe8e"), true);
+  assert.equal(isCommit("90516fc0a1b2c3d4e5f60718293a4b5c6d7e8f90"), true);
+  for (const bad of ["main", "6aabe8e...90516fc", "../x", "6aabe8", ""]) assert.equal(isCommit(bad), false, bad);
+});