Where a child body runs: a placement seam, hosted inside the parent today, Cloudflare/Fly/metal when the tofu spike lands #427

Part of #389.

Intent: spawn must not know where a child runs. A small src/spawn/placement.ts interface (place(plan) -> { url, bodyId }, retire(bodyId)) with one implementation now: hosted, the child runs as an app inside the parent (no SSH, one agent at a time, depth limit so a child cannot spawn without bound). A second implementation (Cloudflare Worker front door + container, Fly, or a metal host) is chosen by the verdict of spike #339 and plugs in here.

Acceptance:

• [ ] hosted placement implemented and tested; limits on children per forge and nesting depth
• [ ] the interface documented in docs/ARCHITECTURE.md with what #339's module must provide (create, health, retire, bucket and credential per child)
• [ ] a follow-up issue for the chosen external placement is opened once #339 decides; this issue stays for the seam only

Order corrected: this seam waits only for #420, and the spawn action #421 waits for it. Only the hosted placement is in scope; the external placement is its own issue, opened when #339 decides (the studio door #426 waits for #339). Ignore the acceptance line about #339 in the description.