Now that resource checking is global (#2386), we should only place the 'global' containers on workers usable by all teams. Otherwise we could end up in a kind of awkward scenario where team A's periodic check ends up running on team B's worker.

Until we can reason about this more easily, let's just make sure check containers are placed on global (non-team) workers.

In the future we'll probably want to support deployments that have exclusively team-scoped workers. We can/should plan that as a later story once someone requests it.