Manager-first deployment model: split runner, merge service/job, frontend→static

Replace the conflated `runner` axis with two orthogonal ones: `manager`
(systemd|caddy|path|none) — who supervises/realizes a deployment — and, for
systemd only, a nested `launcher` (python|command|container|compose|node) — how
the process starts. ServiceSpec and JobSpec collapse into one manager-
discriminated DeploymentSpec union (Systemd/Caddy/Path/Remote); the services/
and jobs/ config dirs collapse into one deployments/ dir. The human "kind"
(service|job|tool|static|reference) is fully derived (kind_for), never stored —
the frontend kind is renamed static. behavior is gone.

- core: DeploymentSpec union + LaunchSpec + kind_for; legacy-aware loader
  normalizes old runner shapes; CastleConfig.deployments with derived
  services/jobs/tools views; registry.Deployment carries manager/launcher/kind.
- cli: service/job/tool as filtered views + a deployment group; --behavior→--kind,
  create --runner→--launcher; lifecycle dispatches over config.deployments.
- castle-api: /deployments primary with /services,/jobs as views; summaries
  derive kind; PUT/DELETE /config/deployments/{name} (services/jobs aliased).
- app: KindBadge, frontend→static everywhere, pick-a-kind creation wizard,
  per-kind config editors.
- docs: single deployments/ layout, manager/launcher, static kind throughout.

Live migration verified byte-identical: regenerated Caddyfile and every unit
ExecStart line unchanged, so nothing restarted. Suites: core 124, cli 25,
castle-api 55; dashboard build + type-check clean.

cli/src/castle_cli/commands/add.py

@@ -91,16 +91,17 @@ def run_add(args: argparse.Namespace) -> int:
         source = str(src_path)
         name = args.name or src_path.name
 
-    if name in config.programs or name in config.services or name in config.jobs:
+    if name in config.programs or name in config.deployments:
         print(f"Error: '{name}' already exists in castle.yaml")
         return 1
 
-    # Detect verbs from the working copy if we have one on disk.
+    # Detect verbs from the working copy if we have one on disk. `kind` is derived
+    # from a deployment, not stored on the program — so `castle add` adopts the
+    # source only; declare a deployment separately (castle service/job create).
     stack: str | None = None
     detected_commands: dict[str, list[list[str]]] = {}
-    behavior = "tool"
     if src_path.exists():
-        stack, detected_commands, behavior = _detect(src_path)
+        stack, detected_commands, _ = _detect(src_path)
 
     prog = ProgramSpec(
         id=name,
@@ -108,7 +109,6 @@ def run_add(args: argparse.Namespace) -> int:
         source=source,
         stack=stack,
         repo=repo_url,
-        behavior=behavior,
     )
     # `build` is declared via BuildSpec; every other verb via CommandsSpec.
     if detected_commands: