forgetest: the bench actuator plugs into the action seam

fixture.py: the bench's /data/forgetest/fixture.json (hostname, key,
optional ip, the channels wired, arm_press), a resolver for
<hostname>.local asked of the network directly (the image has no mDNS
resolver), and the client. The runner probes it before every run and
at most every 30 s otherwise; ctx.act asks it for a channel it covers
and still waits for the machine's own reading, falling back to the
operator's notice when the box fails. A test declares with hands=(...)
what it asks of a person beyond its typed actions; an operator test
with none, whose actions the fixture covers, is routed into the
unattended queue, its Ready gates pass, and a prompt it raises anyway
is a FAIL naming the undeclared step. Live tests never move; their arm
press stays a person's unless the bench opted in, in which case the
fixture presses when the button lights. Whatever the box still holds
after a run is released before the baseline's post pass and recorded.
The page shows what the fixture covers. Contract in ACCEPTANCE.md; the
wiring facts, with the interlock connector left to the bench to settle
(SAFETY.md and the sister map differ), in BRINGUP.

Catalog unchanged in its definitions; the cloud and laser suites'
shared code moved, so their implementation hashes move with it.

forgetest/forgetest/suite/cloud.py

@@ -385,7 +385,7 @@ def mode_switch(ctx):
                                        "machine's identity",
       subsystem="cloud", kind="operator", est_min=5,
       covers=_SERVICE_LAYER,
-      requires=["forgectrl.auth"],
+      requires=["forgectrl.auth"], hands=["app"],
       steps=["Cloud credentials configured; the machine on the network; the app open in a browser "
              "(anyone can drive it, at the machine or not: nothing here moves, arms, or fires).",
              "When told, set up any small job in the app and press Print; the emulator runs it at "