Where the kernel cannot hold a child forge's cores, the forge pauses and resumes its processes to hold them #11559

Part of #11539. A child forge asks for cpu.max (cpuQuota), but where the cpu controller is not delegated cpuCapped stays false and the watch stops the forge instead (production 0.7.540). The chart is not to be touched, so the fallback is in the forge.

Done looks like:

• [ ] A new src/apps/cpu_duty.ts: plain data in (cores used over the last second, the limit), plain data out (how long to pause the tree this second); the watch in src/apps/contain.ts sends SIGSTOP/SIGCONT to the cell's tree on that schedule when cpuQuota is set and cpuCapped is false, and always SIGCONTs on close.
• [ ] The forge's boot line (or the child's row on the machines page) says once which one holds its CPU: "the kernel" or "the forge, by pausing".
• [ ] test/cpu-duty.test.ts: the pure schedule holds a 3-core load near 1 core; with a stub signaller, a cell under the fallback is paused and resumed and never stopped; close resumes a paused tree.
• [ ] Pull pastes bun test test/cpu-duty.test.ts test/contain.test.ts test/cgroup.test.ts passing. After release a person runs the production probe from #11539 (zero child forge stopped lines for a small forge through the stranger journey).