Manager-first deployment model: split runner, merge service/job, frontend→static

Replace the conflated `runner` axis with two orthogonal ones: `manager`
(systemd|caddy|path|none) — who supervises/realizes a deployment — and, for
systemd only, a nested `launcher` (python|command|container|compose|node) — how
the process starts. ServiceSpec and JobSpec collapse into one manager-
discriminated DeploymentSpec union (Systemd/Caddy/Path/Remote); the services/
and jobs/ config dirs collapse into one deployments/ dir. The human "kind"
(service|job|tool|static|reference) is fully derived (kind_for), never stored —
the frontend kind is renamed static. behavior is gone.

- core: DeploymentSpec union + LaunchSpec + kind_for; legacy-aware loader
  normalizes old runner shapes; CastleConfig.deployments with derived
  services/jobs/tools views; registry.Deployment carries manager/launcher/kind.
- cli: service/job/tool as filtered views + a deployment group; --behavior→--kind,
  create --runner→--launcher; lifecycle dispatches over config.deployments.
- castle-api: /deployments primary with /services,/jobs as views; summaries
  derive kind; PUT/DELETE /config/deployments/{name} (services/jobs aliased).
- app: KindBadge, frontend→static everywhere, pick-a-kind creation wizard,
  per-kind config editors.
- docs: single deployments/ layout, manager/launcher, static kind throughout.

Live migration verified byte-identical: regenerated Caddyfile and every unit
ExecStart line unchanged, so nothing restarted. Suites: core 124, cli 25,
castle-api 55; dashboard build + type-check clean.

cli/tests/test_create.py

@@ -74,9 +74,9 @@ class TestCreateCommand:
         assert (project_dir / "CLAUDE.md").exists()
         assert "my-tool2" in config.programs
         comp = config.programs["my-tool2"]
-        assert comp.behavior == "tool"
-        # A tool is a PATH deployment: a `runner: path` service.
-        assert config.services["my-tool2"].run.runner == "path"
+        assert comp.kind == "tool"
+        # A tool is a PATH deployment: manager=path.
+        assert config.deployments["my-tool2"].manager == "path"
 
     def test_create_supabase_app(self, castle_root: Path, tmp_path: Path) -> None:
         """A supabase app scaffolds a Patch-shaped project registered as a static
@@ -104,14 +104,14 @@ class TestCreateCommand:
         assert (project_dir / "public" / "index.html").exists()
         assert (project_dir / "supabase.app.yaml").exists()
 
-        # Registered as a program + a `static` service serving public/
+        # Registered as a program + a caddy (static) deployment serving public/
         comp = config.programs["guestbook"]
-        assert comp.behavior == "frontend"
+        assert comp.kind == "static"
         assert comp.stack == "supabase"
         assert comp.build is not None and comp.build.outputs == ["public"]
-        svc = config.services["guestbook"]
-        assert svc.run.runner == "static"
-        assert svc.run.root == "public"
+        dep = config.deployments["guestbook"]
+        assert dep.manager == "caddy"
+        assert dep.root == "public"
 
     def test_create_duplicate_fails(self, castle_root: Path, capsys: object) -> None:
         """Creating a project with existing name fails."""