#22108 gh-merge-green fast gate: refuse untrusted forks and a skipped fast tier; route web from the full file list

Fixes for three bugs a correctness review found in #20566 at f317d013. This PR targets merge-green-fast because another agent pushed to that branch (24ab8baf) while I was working on it, so I didn't push there. Whoever owns #20566 can merge this in or cherry-pick it. The tests are committed first (3d63242b), before the fix (0f11f22d).

1. An untrusted fork merged on the fast gate. The fork refusal (#21587) lives only in merged_head_checks, and the fast path skips that. So a fork PR into feat-cmux-next, without --trust-fork-head, merged once the fast lanes were green. The fast path now refuses it before the wait. With --trust-fork-head <sha> it still merges, and the trust comment now says it was for the fast gate.
2. A skipped fast tier counted as a pass. On a PR, cmux-next.yml skips cmux-next fast tier only when push-head-preflight is not current (a runner failure or its timeout). A covered change then merged on path routing plus lint alone. It now refuses as "no verdict", which --override can't bypass.
3. Web routing saw at most 100 files. gh pr view --json files stops at 100. The helper now passes the paginated REST/GraphQL list it already has (--files-from).

Not run: the tests. This Mac is over its load limit, and Huge Blue and big-red didn't answer SSH. I checked syntax only (bash -n, py_compile). The new tests are test_a_skipped_fast_tier_has_no_verdict and test_the_callers_full_file_list_routes_web in tests/test_merge_fast_gate.py, plus test_the_fast_gate_refuses_an_untrusted_fork and test_the_fast_gate_merges_a_fork_head_trusted_by_sha in tests/test_gh_merge_green.py.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes three bugs found in a correctness review of the fast merge gate: an untrusted fork could merge on the fast lanes, a skipped fast tier counted as a pass, and web routing saw at most 100 changed files.

Bug Fixes

• The fast gate now refuses an untrusted fork PR before the wait unless --trust-fork-head <sha> names its reviewed head; the recorded trust comment covers the fast-gate scope.
• A skipped cmux-next fast tier now refuses with "no verdict" instead of counting as a pass; --override cannot bypass it.
• Web routing now uses the caller's paginated full file list (--files-from) instead of gh pr view --json files, which stops at 100 files.
• Adds tests for all three fixes and updates docs/ci-runners.md accordingly.