Contained checks and gates install from the repository's shared bun cache, filled by the forge and bound read-only into the cell #7543

Intent: a contained check or gate stops downloading npm every run (#7541): it installs from checkInstallCache(dataDir, repo.id), the same cache uncontained checks share.

Why read-only: the cache is shared by every pull of the repository, forks included. If a cell could write it, one pull could poison a package that the gate on main then installs. So the forge fills it and cells only read it.

Done when:

• [ ] Before a contained install, the forge fills the shared cache on the host from the commit's lockfile: bun install --frozen-lockfile --ignore-scripts into a scratch dir, with BUN_INSTALL_CACHE_DIR set to the shared cache, holding the existing withLock(${shared}.lock) exactly as uncontained installs do (src/checks/install.ts). No lifecycle script runs outside a cell.
• [ ] The cell gets the cache as a read-only bind (the reveal path in src/apps/contain.ts, even though dataDir is hidden) and BUN_INSTALL_CACHE_DIR pointing at it. Nothing else is added to the cell's view; writable stays [].
• [ ] Test: once a lockfile is in the cache, a contained install with the registry pointed at a dead proxy (e.g. BUN_CONFIG_REGISTRY=http://127.0.0.1:1) still succeeds.
• [ ] Test: a write into the cache path from inside the cell fails.
• [ ] Test: the install's output from a warm cache reports no downloads.
• [ ] Cluster jobs (runJobStep) are unchanged and say so in a comment.

Files: src/checks/service.ts (around the shared = line near 995), src/checks/install.ts (a prefillInstallCache helper), src/apps/contain.ts only if a read-only bind needs a new field, and tests beside them.

Risks: a lockfile that names a package the forge cannot fetch must fail the install the same way it does today, not hang on the lock. A cold first fill holds the lock longer, so keep LOCK_STALE_MS in mind. bun install's hardlink backend can't link across a read-only bind on another filesystem: if the cell's checkout is on a different device, use --backend=copyfile.

Brief: a builder who knows src/apps/contain.ts and bwrap binds.