The settings page's check-cell memory card lands with a test that cannot pass vacuously #3150

Replaces #3135, which was handed out twice. Pull #3136 (branch scout/3135-the-settings-page-shows-the-cell-memory) already builds the card: src/web/pages/check-limits.ts, src/apps/check-memory.ts, memoryCeilingSource() in src/apps/contain.ts, wired into src/web/pages/settings.ts. Its reviews asked for one thing more. Finish it on that branch; do not start over.

Done looks like:

• [ ] The test "with no variable set, a cut is blamed on the pod, not on the variable" in test/settings-check-memory.test.ts has no early return. The pod's memory.max path reaches the page through a parameter or a module-level seam (the way memoryCeiling(env, podFile) already takes one), and the test writes its own memory.max fixture (for example 8192 MiB, so the ceiling is 6144) into its temp dir. The test then asserts "forge.json asks 65536 MiB", "75% of the pod's memory.max", and no "FORGE_CELL_MEMORY_MAX_MIB", on every host.
• [ ] Production still reads /sys/fs/cgroup/memory.max once and caches it, not on every request.
• [ ] The pull's description says what it showed: the three page cases (over the ceiling from the env, over it from the pod, at or below it) as text quoted from the rendered page in the test output, because a reviewer cannot open the preview from the sandbox.
• [ ] bun x tsc --noEmit and bun test test/settings-check-memory.test.ts test/settings*.test.ts pass.

Files: test/settings-check-memory.test.ts, src/web/pages/check-limits.ts, src/apps/contain.ts (the seam only). Risk: a seam that is a mutable global leaks between test files; reset it in afterEach, or pass the path as an argument.

Replaced by #3153. Pull #3151 met this issue's ask: no early return, a pod fixture, and the rendered cases quoted. Its reviews then asked for five small changes. #3153 lists exactly those, to be done on the same branch.