Write mesh/check from the forge bridge's own event, never from a tool (K1)

Review finding K1 of R4e, issue 1301 S4 (ADR 0503 §3, ADR 0513 §4: the forge
requires mesh/check alone). gitea_check_status assumed only the bridge could
call it, but a tool is told no caller and node-tools invokes every tool, so any
session could set mesh/check to success and merge past the checker: the fault
issue 293 closed for the two statuses before it.

gitea now consumes mesh-delivery-forge-bridge.check.status, a subject the bus
grants to the bridge's own account alone, and check.ts writes mesh/check from
it: the source is checked, the head's whole sha and the state, and a revision
older than one already written on the head is dropped so a redelivered stale
pending never hides a verdict; a forge refusal throws, so the event is
delivered again. gitea_check_status is removed, and gitea_commit_status keeps
refusing mesh/check.

modules/gitea/module.json

@@ -87,7 +87,8 @@
   ],
   "consumes": [
     "mesh-controller.checked",
-    "node-build-agent.started"
+    "node-build-agent.started",
+    "mesh-delivery-forge-bridge.check.status"
   ],
   "listens": [
     {