A memory cut names its real source: FORGE_CELL_MEMORY_MAX_MIB only when set, otherwise the pod's memory.max share #3145

From #3128. memorySource() in src/apps/contain.ts says "the machine's ceiling, FORGE_CELL_MEMORY_MAX_MIB" for every cut, even when that variable is unset and the ceiling came from 75% of the pod's memory.max (juniper's review on pull #3136). An operator reading the log then goes to change a variable that does not exist.

Done looks like:

• [ ] memoryCeiling() returns where its number came from: env (FORGE_CELL_MEMORY_MAX_MIB), pod (a share of memory.max) or default. memorySource names exactly that source, both in the check log's warning line (limitWarnings) and in the breach summary ("used … over its … MiB limit (…)").
• [ ] Tests cover each source against a stand-in pod file. With the env var set, the text names it. Without it, the text says "75% of the pod's memory.max" and does not mention the variable.

Waits for #3135, whose pull also edits contain.ts. Files: src/apps/contain.ts, src/checks/service.ts, test/contain*.test.ts.