Walls outside the repository: node admission probe, the lane's ServiceAccount/Role/NetworkPolicy, a signed image from trunk, merge rights on the mirror #3028

Later: These walls live in the chart, the release workflow and the Forgejo mirror, which the direction keeps out of the crew's hands; the owner applies them.

From #1436, the parts that are the operator's:

• [ ] A probe pod with the forge's exact securityContext admits a node (vxrail) before the forge or its lane schedules there.
• [ ] The chart grants the check lane (FORGE_CHECKS_* in docs/CLUSTER.md) a ServiceAccount, a namespaced Role for Jobs and pod logs, and a NetworkPolicy selecting the labels src/checks/job_step.ts puts on the Job's pods.
• [ ] The image is built from trunk on an owner-controlled runner and signed; the self-deploy verifies the gate before swapping.
• [ ] Merge rights on the Forgejo mirror are reviewed; a bot with merge rights is a named crew member or has none.

Done when the owner says each is applied.