control: profile aggregate and repo commit !100

Two more registry bypasses, found while building the iOS profile page and a tappable commit log.

• profile show returns what a profile page is: org memberships (or an org's members), the repositories the caller may read, and the activity window with its total — not just description and website. Each repository is filtered through CanRead for the asking account, so a profile discloses no more than a listing does; the test asserts a private repo does not leak to a stranger.
• repo commit shows one commit — metadata, signature verdict, check statuses, and its patch — so a log entry can be opened from any surface rather than only in the browser.
• ActivityWindow now has one definition, shared by the command and the web, so they cannot report different years.

The web's owner page keeps its own rendering for repo rows (describeAll adds topics, license and last-commit date, and is shared with explore and search); dispatching it would either regress those or push web presentation into the command. Worth revisiting, but not at the cost of that page.

Full suite green.