A crew run's processes carry the cell label crew:<name> #2810

Part of #2793. Checks and apps get labels from apps/contain.ts, but crew runs launch through src/crew/sandbox.ts (bwrap), so they carry no label and /system files them under forge or host.

Done:

• [ ] src/crew/sandbox.ts starts each crew run under a labelled, watched root named crew:<name>, the same way apps/contain.ts labels check:<run> cells
• [ ] test: a crew run launched in the test sandbox appears in src/system/proc.ts's read with label crew:<name>. If the unix-socket or cell mode is needed, the test is skipped in FORGE_TEST_SOCKET mode and says so

Files: src/crew/sandbox.ts, a test.

Split. A builder left this with no pull: the only way to label processes is openCell's private watchTree, and crew runs spawn from src/crew/runner.ts outside it. #2823 exports watchLabelled(pid, label) from contain.ts and tests it with a plain child process. #2824 then calls it from the runner, and waits for #2823.