While cells.egress is enforce, a check never runs as a cluster Job: it runs in a cell and says why #3190

Intent: egress stays enforced with nothing to toggle. Today FORGE_CHECKS_PLACEMENT=job runs a check as a cluster Job even under the default cells.egress=enforce, and the Job holds no egress at all (src/checks/service.ts: sandbox enforced: false, "egress not enforced on a cluster job"). Enforcing egress inside a Job is #1428 (Later); this issue is the guard until it lands.

Done looks like:

• [ ] When egressSetting(app.db) is enforce, a job placement is not used for that run: the check runs in a cell as process does, the run records placement: process, and the log has one line saying why, e.g. placement: job skipped, egress is enforced and a Job cannot hold it.
• [ ] When cells.egress is report, the job placement runs as it does today.
• [ ] The run page shows no "ran as a cluster job" for a run that fell back.
• [ ] docs/CLUSTER.md says the lane only applies while cells.egress is report, and that under enforce checks stay in cells.
• [ ] Tests in test/checks-placement.test.ts (or test/checks-job-vanish.test.ts's stand-in Job client): under enforce with a job placement the stand-in client is never called and the run reaches a verdict in a cell; under report it is called. Each test fails without the change.

Files: src/checks/service.ts, docs/CLUSTER.md, test/checks-placement.test.ts. Risks: the decision must be read per run (an admin can flip cells.egress at runtime), not once at boot with the placement. Do not touch charts/. Fits: a builder's brief for check-lane work (scout or mason).