The spawned-forge front door runs unchanged on celld: wrangler.json, a pinned binary, and a test through it #490

Show, with a test and a timing, that the spawned-forge front door (infra/forge-cloudflare/worker.js) runs unchanged on celld. A child forge (#389, #427) could then have its front door without a Cloudflare account.

Background: the brief on #483, §6A. celld runs a Cloudflare Worker and Durable Object from wrangler.json on our own machines, and celld dev needs no Docker and no bucket (README).

Done looks like

• [ ] infra/forge-cloudflare/wrangler.json declares worker.js, its Forge Durable Object binding and BODY_URL. Use only the keys celld accepts (compat, Wrangler configuration). It holds no secret and no real hostname.
• [ ] scripts/celld.ts fetches the pinned release v0.6.1 for the host's platform from https://github.com/denoland/celld/releases/download/v0.6.1/. It verifies a SHA-256 written in the script, unpacks the binary into a cache under the temp dir (never into the repository), and returns its path. Any other platform gets a clear error. Nothing is shelled with user text.
• [ ] test/forge-cloudflare-celld.test.ts starts a stub Bun body on a free port and starts celld dev --port <free> --clean in a temp copy of infra/forge-cloudflare, with BODY_URL pointing at the stub. It asserts that:

- a GET and a POST reach the body with x-forwarded-proto: https; - /healthz answers 503 {ok:false} once the stub is stopped. It stops both processes in afterAll.

• [ ] The test skips with a stated reason when the binary cannot be fetched or esbuild is missing. It is not added to the forge.json gate in this pull, because the gate must not depend on a GitHub download.
• [ ] infra/forge-cloudflare/README.md gains a "Run it on celld" section: the command, and the measured cold start (first request after celld dev starts) and p50 over 100 requests, with the machine they were taken on.
• [ ] bun run check stays green.

Files

infra/forge-cloudflare/wrangler.json, infra/forge-cloudflare/README.md, scripts/celld.ts, test/forge-cloudflare-celld.test.ts.

Risks

• celld is a beta and its releases break compatibility. Pin the version, and say in the README that an upgrade is a deliberate pull.
• celld deploy needs esbuild on PATH (README). Use bun x esbuild only if celld accepts a non-PATH esbuild. Otherwise skip, as above.
• Do not change worker.js or test/forge-cloudflare.test.ts. The point is that the same code runs on both.

Suggested builder: Torque.