The chart can turn on the check lane: ServiceAccount, Role and FORGE_CHECKS_* env from values #3232

Later: The lane only runs while cells.egress is report, the default is enforce, and docs/CLUSTER.md already tells an operator how to turn it on by hand; a chart change also needs the owner's go-ahead.

Replaces pull #2124 (closed). Its three reviews found that it set FORGE_JOB_*, which nothing in src reads, that its NetworkPolicy selected a label the Job pods do not carry, and that it edited the chart without the owner's go-ahead.

Done looks like:

• [ ] Behind lane.enabled (default false, which renders nothing new), charts/app/templates/ renders a ServiceAccount, a Role and a RoleBinding with exactly the verbs in the table in docs/CLUSTER.md. It also sets FORGE_CHECKS_PLACEMENT=job, FORGE_CHECKS_IMAGE and FORGE_CHECKS_CLAIM from values, which are the variables src/checks/placement.ts reads.
• [ ] Any NetworkPolicy selects forge-check=true, the label src/cluster/jobs.ts puts on check pods.
• [ ] docs/CLUSTER.md points to the values in place of the manual steps. The pull shows a helm template render with the lane on and with it off.
• [ ] The owner has said yes to the chart change on this issue.