Manager-first deployment model: split runner, merge service/job, frontend→static

Replace the conflated `runner` axis with two orthogonal ones: `manager`
(systemd|caddy|path|none) — who supervises/realizes a deployment — and, for
systemd only, a nested `launcher` (python|command|container|compose|node) — how
the process starts. ServiceSpec and JobSpec collapse into one manager-
discriminated DeploymentSpec union (Systemd/Caddy/Path/Remote); the services/
and jobs/ config dirs collapse into one deployments/ dir. The human "kind"
(service|job|tool|static|reference) is fully derived (kind_for), never stored —
the frontend kind is renamed static. behavior is gone.

- core: DeploymentSpec union + LaunchSpec + kind_for; legacy-aware loader
  normalizes old runner shapes; CastleConfig.deployments with derived
  services/jobs/tools views; registry.Deployment carries manager/launcher/kind.
- cli: service/job/tool as filtered views + a deployment group; --behavior→--kind,
  create --runner→--launcher; lifecycle dispatches over config.deployments.
- castle-api: /deployments primary with /services,/jobs as views; summaries
  derive kind; PUT/DELETE /config/deployments/{name} (services/jobs aliased).
- app: KindBadge, frontend→static everywhere, pick-a-kind creation wizard,
  per-kind config editors.
- docs: single deployments/ layout, manager/launcher, static kind throughout.

Live migration verified byte-identical: regenerated Caddyfile and every unit
ExecStart line unchanged, so nothing restarted. Suites: core 124, cli 25,
castle-api 55; dashboard build + type-check clean.

app/src/components/detail/ServiceFields.tsx

@@ -1,6 +1,6 @@
 import { useState } from "react"
 import type { ServiceDetail } from "@/types"
-import { runnerLabel } from "@/lib/labels"
+import { launcherLabel } from "@/lib/labels"
 import { Field, TextField, FormFooter, useEnvSecrets } from "./fields"
 
 interface Props {
@@ -33,7 +33,7 @@ export function ServiceFields({ service, onSave, onDelete }: Props) {
 
   const { element: envEditor, merged } = useEnvSecrets(obj(obj(m.defaults).env) as Record<string, string>)
 
-  const runner = (run.runner as string) ?? "?"
+  const launcher = (run.launcher as string) ?? "?"
 
   const handleSave = async () => {
     setSaving(true)
@@ -43,11 +43,11 @@ export function ServiceFields({ service, onSave, onDelete }: Props) {
       delete config.id
       config.description = description || undefined
 
-      // Only python/command run specs are edited here; other runners
-      // (container/node/remote) keep their original run block untouched.
+      // Only python/command launchers are edited here; other launchers
+      // (container/node/compose) keep their original run block untouched.
       const runOut = obj(config.run)
-      if (runner === "command") runOut.argv = runProgram.split(" ").filter(Boolean)
-      else if (runner === "python") runOut.program = runProgram
+      if (launcher === "command") runOut.argv = runProgram.split(" ").filter(Boolean)
+      else if (launcher === "python") runOut.program = runProgram
       config.run = runOut
 
       if (port) {
@@ -83,7 +83,7 @@ export function ServiceFields({ service, onSave, onDelete }: Props) {
         label="Runs"
         hint="The console script (python runner) or command this service executes."
       >
-        <span className="text-sm font-mono text-[var(--muted)]">{runnerLabel(runner)} &middot; </span>
+        <span className="text-sm font-mono text-[var(--muted)]">{launcherLabel(launcher)} &middot; </span>
         <input
           value={runProgram}
           onChange={(e) => setRunProgram(e.target.value)}