Add ESLint rule banning main-thread imports in *_JobRunFns.ts

[sroussey]

Roadmap: prd/roadmap/libs.md

Workers have isolated globalServiceRegistry. *_JobRunFns.ts must not import globalServiceRegistry, getGlobalCredentialStore, etc. Contract is documented in AGENTS.md but not enforced in CI.

Grades: prd/analysis/grades/libs.md recommendation #3