V3 Part 3: keep CI runs per minute so the CI lane covers the full 24 hours #82

Part 3 of the V3 batch. Depends on Part 2 for its last criterion (the shared check's comment and visual-baseline.json) and needs an allow-test-changes: line, because it edits test/day.test.mjs lines 172-174. Not agent-ready until Part 2 has merged and Raghav or Claude Lead has added that line.

Why

The live CI lane is mostly hatched as "Older runs aren't kept", because CI runs live only in the replay buffer. Keeping CI per minute outside the replay makes the lane cover the full 24 hours. Every merge to main deploys live.setkernel.com.

Acceptance criteria

• CI is kept per minute for the last 24 hours as [minute, passes, failures] rows, in state or its own key, not replay. Failures keep their repo in a capped list, and the 20-run feed list stays. New cases in test/state.test.mjs pass under npm test.
• prep draws the CI lane and the ?wall CI column from the per-minute rows. ciFrom is null on a full busy day, and the lane draws the same tick and red bar it does now. New cases in test/day.test.mjs pass.
• A day of 2,000 runs serialises under 128 KiB for the value that holds it, proven by a byte-length test, and the existing replay size test passes unchanged.
• Minutes are epoch minutes, so a Halifax clock change neither drops nor doubles a CI minute, proven by a test across the November change.
• Nothing the private-repos gate hides reaches the rows: a run without a repo still shows as "a private project". node --test test/private-repos-gate.test.mjs test/private-repos.test.mjs passes unchanged.
• The sk-visual head=<sha> comment shows ?demo, ?demo=full and ?wall&demo, with the CI lane unhatched in ?demo=full, and the CI-lane entry is removed from visual-baseline.json. If the PR changes how a mark looks, it waits for Raghav's pick from the shots.
• npm run validate passes and the required visual-diff check passes on the head.

Files likely touched

public/lib/state.js, public/lib/day.js, public/lib/chart.js, public/lib/words.js, public/app.js, src/worker.js (only if a new storage key is used), test/state.test.mjs, test/day.test.mjs, visual-baseline.json.

Risk class

R2; R3 if src/** changes. Every merge deploys live.setkernel.com; Raghav merges.