Where a child body runs: a placement seam, hosted inside the parent today, Cloudflare/Fly/metal when the tofu spike lands #434

This adds the placement seam and one implementation, hosted placement. I ran only the two spawn test files (10 tests, all pass). I started the full bun test but it hadn't finished when I pushed, so I haven't seen it pass.

What changed

• src/spawn/placement.ts defines the Placement interface: place(plan) returns { url, bodyId } and retire(bodyId) is idempotent. Both return a Result, and refusals carry a reason (children, depth, exists).
• hostedPlacement runs the child as an app inside the parent at https://<name>.<host>, with no SSH and one agent at a time.
• It refuses past MAX_CHILDREN (5) hosted children per forge and past MAX_DEPTH (2) levels of nesting. It also refuses a duplicate child name. Retiring a child frees its slot.
• test/spawn-placement.test.ts covers placement, both limits, a duplicate name, and idempotent retire.
• docs/ARCHITECTURE.md has a new section, "Where a child body runs". It lists what #339's module must provide: create, health, retire, and a separate bucket and credential per child. The Placement interface has no health method yet; the doc says to add one when the first external module needs it.

What I left out

• Hosted bodies are kept in an in-memory BodyStore, so they are lost on restart. Persisting them in bun:sqlite under FORGE_APP_DATA belongs with the code that calls spawn, which doesn't exist yet.
• Nothing calls the seam yet.
• I did not open the follow-up issue for the external placement. It waits for #339 to decide.

To try it Run bun test test/spawn-placement.test.ts.

🤖 Generated with Claude Code

Closes #427