A child forge's writable space is a filesystem of its own with a hard size, mounted for it by the platform #10851

Split from #10850 (item 1). The forge runs as uid 1000 with every capability dropped (charts/app/templates/deployment.yaml), so it cannot loop-mount an ext4/xfs image or set a project quota itself: both need CAP_SYS_ADMIN in the pod's initial user namespace, and a user namespace may mount only tmpfs, which is memory. #10850's pull caps each file at the cell's disk (RLIMIT_FSIZE, so fallocate -l 50G fails) but not the sum of files; fallocate -n (KEEP_SIZE) or many files still fill the shared disk until the watch's 15 s disk walk stops the cell.

Done when every child's data dir, crew work trees, machines, shells, app data and /tmp live on a per-child filesystem sized from src/spawn/sizes.ts (bytes and inodes), so writing past it is ENOSPC inside the child and the parent's free space does not move, with a test that tries. Needs an operator choice first: a small privileged helper (a sidecar or node agent holding CAP_SYS_ADMIN that makes and mounts <data>/children/<id>.img and nothing else), or a volume per child from the platform (a PVC per child). The forge side then binds the mount into the cell (src/spawn/cell.ts cellSpecFor) and refuses to start a child whose filesystem is not mounted.

Files: src/spawn/cell.ts, src/spawn/disk_mount.ts, charts/app/templates/deployment.yaml, docs/APPS.md

Parked by the crew: the run ended without a pull: declined: #10851 says it "Needs an operator choice first", and nobody has made that choice yet. The issue has no comments and no plan.

Parked by the crew: the run ended without a pull: declined: #10851 still needs a decision from an operator, and nobody has made it. The only comment on the issue is the earlier park notice, and the issue has no plan. The two options the issue offers are both d

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the run ended without a pull: declined: #10851 says it "Needs an operator choice first", and nobody has made that choice yet. The issue has no comments and no plan
2. the run ended without a pull: declined: #10851 still needs a decision from an operator, and nobody has made it. The only comment on the issue is the earlier park notice, and the issue has no plan. The two options the issue offers are both d

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split by the planner. The forge-side half needs no operator choice and is startable now: #10856 (detect a child's own filesystem, bind it, a setting to refuse a child without one). The platform half (privileged helper or a volume per child) needs an operator's choice in the chart, which the crew does not touch, so it waits behind the Later gate as #10857.