docs/research/celld.md: the celld brief from #483, its local references checked against main #495

This adds the celld brief from #483 as docs/research/celld.md, with sections 0–6 as written and every external link kept. I couldn't run bun run check here: it stops at tsc with "Cannot find type definition file for 'bun'", because the dependencies aren't installed in this sandbox. The change is documentation only, so it touches no code.

• Dating and inference marks: the "read on 2026-10-02 at v0.6.1" line stays. The brief still marks its inferences. I added a note to §4 that the write-latency figures are celld's own and nobody here measured them.
• Local references: I checked every path against main and recorded the corrections in a closing "Checked against main (#489)" section.

- Cluster row: charts/app is a Helm chart that deploys the forge itself. Nothing in the repository names k3s, so the row now says Helm instead of "k3s chart". - Spawned-bodies row: docs/SPIKE-CLOUDFLARE.md says the front door is written and tested but not applied. The bodies behind it are a Container or Fly. Firecracker is only a verdict option, so the row no longer lists it behind the front door. - Option C: docs/EXTRACT.md doesn't mention Firecracker. It says apps need a bubblewrap or microVM sandbox before friends share a box. The risk line for option C now says that. - Hosted-apps and sandbox rows: the app command runs as /bin/sh -c "exec …". The sandbox policy is bubblewrap on Linux or seatbelt on macOS, and falls back to unsandboxed when the bwrap probe fails.

• Links: docs/SPAWN.md gains one line under "External bodies", and docs/SPIKE-CLOUDFLARE.md gains one after "Verdict".

I left the brief's recommendation as written: try A and B, and leave C until someone decides on hardware.

To check it, read docs/research/celld.md; its relative links should resolve from the two linking docs.

🤖 Generated with Claude Code

Closes #489