src/cluster/jobs.ts creates, watches, streams the log of, and deletes a Kubernetes Job, tested against a stand-in client #1691

Split from #1592 (a person's ask). Module only; nothing runs through it yet.

Done looks like:

• [ ] No dependency: the kube API over the service account (token and CA from the standard paths, injectable). Plain data in: image, command, env, node selector, tolerations; plain data out: exit code and log lines.
• [ ] Tests with a stand-in HTTP client: a Job succeeds, fails, times out and is deleted in every case.

Start from today's main (0.7.107 or later). Before pushing run bun x tsc --noEmit, the test files this touches and test/check-list.test.ts; name every new test file in GATE in scripts/gate.ts in the same commit. Earlier tries went red because their branch was cut before main changed the home and asks tests: if the check is red on a test this pull does not touch, merge origin/main, run that test here, and push again; if it is still red, name it in the pull.