The chart's opt-in check lane sets the FORGE_CHECKS_* names the code reads and limits pods by the label Job pods carry #2201

Later: The direction keeps crew work off the Helm chart until the owner authorises a chart change, and #1423 is closed.

From pull #2124, closed. Its RBAC and NetworkPolicy were close to approvable, but the owner has to agree to a chart change first.

Done looks like:

• [ ] With lane.enabled=true, the chart renders a ServiceAccount, a narrow Role and a NetworkPolicy. It sets the env names src/checks/placement.ts reads (FORGE_CHECKS_PLACEMENT, _IMAGE, _CLAIM, _NODE_SELECTOR, _TOLERATIONS). With the default false, nothing new renders.
• [ ] The NetworkPolicy selects the label src/checks/job_step.ts puts on Job pods (JOB_LABELS).
• [ ] A test asserts that every env name the chart sets is read in placement.ts and that the policy label equals JOB_LABELS. The pull shows one rendered helm template output.
• [ ] docs/CLUSTER.md and the README name only variables and labels that exist in the code.

Files: charts/app/templates, charts/app/values.yaml, docs/CLUSTER.md, test/. Brief: torque.

Dropped as a duplicate of #2265. It asks for the same chart lane, with the same FORGE_CHECKS_* names, JOB_LABELS selector and rendered proof, and #2265 waits behind the Later gate. Pull #2124 is closed in favour of #2265.