docs/CLUSTER.md says exactly what an operator applies to turn the check lane on, matching what the code reads #2287

Replaces pull #2124's intent without touching the chart, which belongs to the owner.

Done looks like:

• [ ] A new docs/CLUSTER.md lists:

- the Role verbs src/cluster/jobs.ts uses, with why each one is needed; - every FORGE_CHECKS_* variable src/checks/placement.ts reads, with an example value; - the label check Job pods carry (JOB_LABELS in src/checks/job_step.ts), for a NetworkPolicy to select; - how to confirm the lane is on.

• [ ] Test: the doc names every FORGE_CHECKS_* variable that placement.ts reads, and the JOB_LABELS key, so the doc fails the test if it drifts from the code.
• [ ] No change under charts/.