Manager-first deployment model: split runner, merge service/job, frontend→static

Replace the conflated `runner` axis with two orthogonal ones: `manager`
(systemd|caddy|path|none) — who supervises/realizes a deployment — and, for
systemd only, a nested `launcher` (python|command|container|compose|node) — how
the process starts. ServiceSpec and JobSpec collapse into one manager-
discriminated DeploymentSpec union (Systemd/Caddy/Path/Remote); the services/
and jobs/ config dirs collapse into one deployments/ dir. The human "kind"
(service|job|tool|static|reference) is fully derived (kind_for), never stored —
the frontend kind is renamed static. behavior is gone.

- core: DeploymentSpec union + LaunchSpec + kind_for; legacy-aware loader
  normalizes old runner shapes; CastleConfig.deployments with derived
  services/jobs/tools views; registry.Deployment carries manager/launcher/kind.
- cli: service/job/tool as filtered views + a deployment group; --behavior→--kind,
  create --runner→--launcher; lifecycle dispatches over config.deployments.
- castle-api: /deployments primary with /services,/jobs as views; summaries
  derive kind; PUT/DELETE /config/deployments/{name} (services/jobs aliased).
- app: KindBadge, frontend→static everywhere, pick-a-kind creation wizard,
  per-kind config editors.
- docs: single deployments/ layout, manager/launcher, static kind throughout.

Live migration verified byte-identical: regenerated Caddyfile and every unit
ExecStart line unchanged, so nothing restarted. Suites: core 124, cli 25,
castle-api 55; dashboard build + type-check clean.

docs/stacks/python-cli.md

@@ -318,30 +318,33 @@ uv run ruff check .         # Lint
 uv run ruff format .        # Format
 ```
 
-## Registering in castle.yaml
+## Registering in the registry
 
 ```yaml
-programs:
-  my-tool:
-    description: Does something useful
-    source: /data/repos/my-tool
-    stack: python-cli
-    behavior: tool
+# programs/my-tool.yaml
+description: Does something useful
+source: /data/repos/my-tool
+stack: python-cli
+```
+```yaml
+# deployments/my-tool.yaml (manager: path → kind: tool)
+program: my-tool
+manager: path
 ```
 
 Tools with system dependencies declare them directly on the program:
 
 ```yaml
-programs:
-  pdf2md:
-    description: Convert PDF files to Markdown
-    source: /data/repos/pdf2md
-    stack: python-cli
-    behavior: tool
-    system_dependencies: [pandoc, poppler-utils]
+# programs/pdf2md.yaml
+description: Convert PDF files to Markdown
+source: /data/repos/pdf2md
+stack: python-cli
+system_dependencies: [pandoc, poppler-utils]
 ```
 
-Tools live in the `programs:` section. If a tool also runs on a schedule,
-add a separate entry in the `jobs:` section referencing the program.
+A tool is a `programs/<name>.yaml` entry plus a `deployments/<name>.yaml` with
+`manager: path` (derived **kind: tool**). If a tool also runs on a schedule, add
+a *second* deployment with `manager: systemd` + `schedule` (derived **kind:
+job**) referencing the same program.
 
 See @docs/registry.md for the full registry reference.