tower: collapse the four per-workspace overview forge calls into one GraphQL query

[waleedkadous]

Context

#1645 fixed the runaway: Tower no longer re-spawns forge commands on every 2.5 s dashboard
poll, and it now suspends on a rate limit. Steady state came down from ≈9,090 gh
spawns/hour to 52 per watched workspace per hour.

What #1645 deliberately did not do is item 4 of its prescribed fix — collapse the
per-workspace overview fetch into a single GraphQL request. It was left out because it
does not fit BUGFIX: it is a change to the forge abstraction shipped to adopters, not a
localized fix.

What is left to do

OverviewCache makes four GitHub-API-backed calls per workspace per refresh window:

concept	command	cost
pr-list	gh pr list --json …	1 GraphQL request
issue-list	gh issue list --limit 200 --json …	2 pages
recently-closed	gh issue list --state closed --search 'closed:>…' --limit 1000	multi-page search
recently-merged	gh pr list --state merged --search 'merged:>…' --limit 1000	multi-page search

All four ask the same repo for overlapping data. One gh api graphql query can return
open PRs, open issues, and both 24 h search windows in a single request, taking the
per-workspace cost from ~4 calls (and well over 4 points) to 1.

Why it needs AIR rather than BUGFIX

It is not a one-file change:

• a new forge concept (overview-bundle or similar) added to KNOWN_CONCEPTS;
• a GitHub script issuing the combined query, plus the response-shape mapping;
• a contract type in forge-contracts.ts, since the concept returns a composite
  rather than one of the existing list shapes;
• fallback behaviour for gitlab/gitea/linear and for any project that overrides or
  disables the concept — OverviewCache must still work by making the four calls;
• codev doctor concept reporting and the spend projection in
  servers/overview-budget.ts both need updating;
• tests on both the bundle path and the fallback path.

Correction to carry forward

#1645's text suggested moving the two --search calls to REST gh api search/issues for
"a separate 5,000 budget". That is wrong and should not be done — the GitHub search
resource is 30 requests per minute, not 5,000 per hour (measured on this account:
{"limit":30,"remaining":30}). Collapsing into one GraphQL query is the right direction.

Acceptance

• One forge call per workspace per refresh window on GitHub.
• Non-GitHub forges, and any project that disables the concept, keep working via the
  existing four calls.
• projectHourlyForgeCalls reflects the new call count, and codev doctor reports it.

Follow-up to #1645. Refs #1641, #1629.

[waleedkadous]

Correction: #1646 was superseded, not merged

This issue's body says PR #1646 shipped part of the fix. It did not — #1646 was closed
unmerged on 2026-09-08 and the core is being rebuilt on a fresh branch (architect decision;
ten rounds of fix-on-fix, and one commit whose message described changes it did not contain).

So the behaviour this issue builds on does not exist yet. Read the body as describing the
design that #1645's rebuild will land, not the current state of main.

The specific invariants are captured as one-line testable statements in the rebuild's pitfall
list (/tmp/bugfix-1645-pitfalls.md, attached to the #1645 lane), including the ones this
issue depends on. Sequence this work after the rebuild lands.