Pin oxygenflow 90a3782c (oxygen e7cb3acb): bucket repositories read entries from a journal (oxygen#116) 1c4ad601ef9d

## Unreleased

- **Push protection (#268):** the hub refuses a push that adds what looks like a credential (cloud keys, GitHub, GitLab and OxygenHub tokens, Slack and Stripe keys, private keys; rules v1), naming each by file, line and a fingerprint, never the secret itself, and saying how to take it out (`oxy amend`) and to revoke it if real. Nothing of a refused push is stored. A maintainer can allow one fingerprint with a reason (Settings › Push protection, audited); the setting is on for every repository and can be turned off there. Only what a push adds is scanned, within `[limits] scan_limit` (16 MiB), `scan_file_limit` (1 MiB) and `scan_time_ms` (2 s); a push past them is accepted and its push log says how much went unscanned. Existing history is not scanned yet.

- **Land when checks pass, or land now over them (#261):** anyone who may land a proposal can set it to land by itself, on the proposal, through `POST`/`DELETE …/proposals/{n}/auto-land` or with `oh proposal land N --when-ready` (`--off` to clear it). Once every required check has passed and nothing else blocks it, it lands as the person who set it, if they may still land. A required check that fails or is cancelled turns it off with a note on the timeline; a push to the source makes it wait again. When required checks are the only thing in the way (pending, or failed with the runners down), a maintainer may land now with a reason: on the proposal, with `{"over_checks": "reason"}` on the API's land, or `oh proposal land N --over-checks REASON`. Only the checks are passed over; approvals, code owners, requested changes, drafts, dependencies and the trust policy still apply. Both are audited, and the proposal, its timeline and the pushes page say how it landed.

- **The repository bar has an Artifacts menu and a More menu (#254):** the bar is now Code, Changes, Proposals, Issues, Flow, Releases, Wiki, Artifacts, More and Settings, and no longer wraps. Artifacts holds Releases, Build artifacts (every run's outputs in one list, new), Images (the runner images the repository's jobs used, new), Terraform state and Reports; More holds Bookmarks, Tags, Diffusion, Trust, Pushes and Conflicts. Projects leaves the bar (it is on the site band and every profile). The menus work without JavaScript.