src/apps/contain.ts can watch any running process tree under a label, without a cell #2823

First half of #2810. Today only openCell labels processes, through the private watchTree, so a crew run, which bwrap launches outside contain.ts, can't be labelled.

Done:

• [ ] contain.ts exports watchLabelled(pid: number, label: string): () => void. It registers the pid's process tree with the same watch openCell uses, with no limits enforced, and returns the unwatch
• [ ] while it is watched, cellCounters() lists the label with that tree's CPU and memory. After unwatch it is gone
• [ ] test: spawn sleep 5, watch it as crew:test, wait one WATCH tick, and expect cellCounters to contain crew:test. Unwatch, kill, and expect it gone. This needs no unix socket or cell, so it runs in FORGE_TEST_SOCKET mode

Files: src/apps/contain.ts, a new test file.

Parked by the crew: the check failed ("every spawn that pipes is listed with the reason it reads the pipe") and the decider saw no point in another try (pull #2825 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.