src/cluster/jobs.ts creates, watches, streams the log of, and deletes a Kubernetes Job, tested against a stand-in client #1699

I added src/cluster/jobs.ts and test/cluster-jobs.test.ts, and pushed them. Nothing calls the module yet. bun x tsc --noEmit, the new test file and test/check-list.test.ts pass locally; I did not run the rest of the suite.

What it does

• Run: runJob(spec, opts) creates a Job, polls it, reads the pod's log and always deletes the Job afterwards. That includes success, failure, timeout and an API error.
• No dependency: it talks to the kube API with fetch, using the service account's token, CA and namespace from the standard paths. The client, the credentials, the clock and the sleep are all injectable.
• In: a plain JobSpec: name, image, command, env, nodeSelector, tolerations. The name, image, command and env names are validated before any call is made.
• Out: { exitCode, lines, timedOut }. The exit code comes from the container's terminated state. It is null on a timeout.
• Manifest: backoffLimit is 0 and ttlSecondsAfterFinished is 600, so a Job the delete misses is still cleaned up.
• Tests: a stand-in kube API covers a Job that succeeds, fails and times out, plus an API error and a bad spec. Each case checks the Job is deleted, or that no call was made for a bad spec. A further test covers reading the service account.
• Gate: test/cluster-jobs.test.ts is added to GATE in scripts/gate.ts.

Left out

• Polling: it polls the Job status instead of using the kube watch stream, because a watch needs chunked JSON parsing and reconnects for little gain here.
• Log: it reads the log once after the Job finishes rather than streaming it. It is capped at 1 MB, keeping the last 1 MB.
• Pods: it reads only the first pod's first container. backoffLimit is 0, so there is one pod.
• Not run: nothing was tried against a real cluster, and the unix-socket suites are skipped in this sandbox.

Closes #1691

All three review points are fixed and pushed. bun x tsc --noEmit, test/cluster-jobs.test.ts and test/check-list.test.ts pass (16 tests).

• Create no longer deletes another run's Job. The Job is marked as this call's only once the POST succeeds. A 4xx answer, including 409 AlreadyExists, sends no DELETE. A 5xx or a dropped connection still deletes, since the create may have gone through. New test: a POST that answers 409 sends no DELETE.
• The log is bounded and read as a stream. The log request now carries ?limitBytes=. The body is read chunk by chunk and stops at maxLogBytes (default 1 MB), counted in bytes, so the full log is never held in memory. New test: a log over the cap comes back truncated by bytes, and the request carries limitBytes.
• The kube answers are typed. any is replaced by small Job, Pod and PodList types covering only the fields used.

One behaviour changed: a log over the cap now keeps its first bytes, not its last, because limitBytes bounds from the start.

The log is read once after the Job finishes, not followed live, so "streams" means a bounded read of the body. A live follow would need ?follow=true and a reader that runs alongside the polling loop. I left that out as more than this module needs while nothing calls it, and can add it if you want it.