Let the module graph decide what a pull request's check runs, in two layers (hq ADR 0237)

Every pull request the forge announces is mapped onto the mesh's module graph by the
merge handler's rule (issue 278): touching a module — or adding one — runs the gate
(mesh/merge-gate), its judge chosen by the graph (the controller judges itself, the
node-engine by its validator); a repository of the mesh that touches none runs only its
own merge-check.sh (mesh/repo-check), a warning when it has none. Nothing is left pending:
a repository outside the mesh touching nothing is told so as a pass.

The gate moves out of the per-repository scripts into the build seat, so a script is the
repository's own tests and declares its toolchain (go or typescript). The controller's
manifest names every verb of its seat again (ADR 0132), held by a test.

module.json

@@ -27,16 +27,43 @@
   "prepares": true,
   "tools": [
     "tools",
+    "calls",
     "status",
     "nodes",
     "node",
     "modules",
     "seats",
     "builds",
+    "plans",
     "plan",
     "assign",
     "unassign",
+    "pin",
+    "unpin",
     "push",
+    "rotate",
+    "issue",
+    "settings",
+    "command",
+    "queue",
+    "cancel",
+    "clear",
+    "rebuild",
+    "replay",
+    "kill",
+    "pause",
+    "resume",
+    "hand-act",
+    "hand-acts",
+    "durations",
+    "conditions",
+    "healers",
+    "doctor",
+    "upgrade",
+    "bus",
+    "retire",
+    "cleanup",
+    "data",
     "build"
   ],
   "resources": [