While cells.egress is enforce, a check never runs as a cluster Job: it runs in a cell and says why #3191

Under cells.egress=enforce, a job placement is now skipped and the check runs in a cell instead. The placement and vanish tests pass (12 of 12). I could not run bun x tsc --noEmit: bun failed with a read-only tempdir error here, so the type check is unverified.

• src/checks/service.ts: egressSetting(app.db) is read for each run, so an admin flipping it takes effect on the next check. Under enforce the run records placement: process and logs placement: job skipped, egress is enforced and a Job cannot hold it. Under report the Job lane works as before. A fallen-back run has placement: process, so its page shows no "ran as a cluster job".
• docs/CLUSTER.md: a new section says the lane applies only while cells.egress is report, and that under enforce checks stay in cells.
• test/checks-placement.test.ts:

- The existing job tests now set report, since enforce is the default. - A new enforce test checks the stand-in client is never called, the run reaches a verdict in a cell, the log has the skip line, and the page has no "cluster job". - A second new test flips to report and checks the next check goes to a Job.

• test/checks-job-vanish.test.ts: it sets report too, because it needs the Job lane.
• Fails without the change: I stashed src/ and re-ran the placement tests, and one failed. I didn't look at which; the enforce test should be the one.

I left charts/ and enforcing egress inside a Job (#1428) alone.

Closes #3190

Under cells.egress=enforce, a job placement is now skipped and the check runs in a cell instead. The placement and vanish tests pass (12 of 12). I could not run bun x tsc --noEmit: bun failed with a read-only tempdir error here, so the type check is unverified.

• src/checks/service.ts: egressSetting(app.db) is read for each run, so an admin flipping it takes effect on the next check. Under enforce the run records placement: process and logs placement: job skipped, egress is enforced and a Job cannot hold it. Under report the Job lane works as before. A fallen-back run has placement: process, so its page shows no "ran as a cluster job".
• docs/CLUSTER.md: a new section says the lane applies only while cells.egress is report, and that under enforce checks stay in cells.
• test/checks-placement.test.ts:

- The existing job tests now set report, since enforce is the default. - A new enforce test checks the stand-in client is never called, the run reaches a verdict in a cell, the log has the skip line, and the page has no "cluster job". - A second new test flips to report and checks the next check goes to a Job.

• test/checks-job-vanish.test.ts: it sets report too, because it needs the Job lane.
• Fails without the change: I stashed src/ and re-ran the placement tests, and one failed. I didn't look at which; the enforce test should be the one.

I left charts/ and enforcing egress inside a Job (#1428) alone.

The type error is fixed and pushed, but I haven't type-checked it. bun install and tsc both fail in this sandbox on a read-only tempdir, so the forge's check on the push is the first real type check. The two affected test files pass (12 of 12).

The error was in my new enforce test, which built a job placement without nodeSelector and tolerations. I added them as an empty selector and an empty list in test/checks-placement.test.ts. Only the test changed.

The rest of the pull is as described before. Under cells.egress=enforce, a job placement is skipped for that run. The check runs in a cell, records placement: process, and logs why. Under report the Job lane runs as before. docs/CLUSTER.md says the lane applies only while egress is report.