Clouds, step 1: `cloud.json` declares which vendor uses an app or repository may make, nothing by default, and docs/CLOUD.md states the rule #1684

Split from #1146 (the owner's ask: clouds as capacity, never as dependency).

Done looks like:

• [ ] cloud.json parsed and validated next to forge.json (src/apps/manifest.ts): a list of {vendor, use, why} from a closed set; a bad file is refused with one sentence.
• [ ] One function mayUse(repo, vendor, use) that every later vendor call goes through; with no cloud.json it is always no.
• [ ] docs/CLOUD.md: the rule (the forge runs, backs up and restores with no vendor attached; what leaves through a vendor is end-to-end encrypted or already public; every use is declared and has a way back).
• [ ] Tests: no file → every use refused; a declared use allowed; an undeclared one refused; a malformed file refused.

Start from today's main (0.7.107 or later). Before pushing run bun x tsc --noEmit, the test files this touches and test/check-list.test.ts; name every new test file in GATE in scripts/gate.ts in the same commit. Earlier tries went red because their branch was cut before main changed the home and asks tests: if the check is red on a test this pull does not touch, merge origin/main, run that test here, and push again; if it is still red, name it in the pull.