Manager abstraction + manager-dispatched lifecycle; frontends create static services

- manifest: `manager_for(runner)` — the single source of truth mapping a runner to
  its manager (systemd | caddy | path | none). deploy's `managed` now derives from it.
- lifecycle: is_active/activate/deactivate dispatch by manager instead of behavior
  (removed the stale `_is_static_frontend`, which broke once frontends became
  services). caddy → gateway reload; path → install/uninstall; none → no-op.
- cli/service: start/stop/restart and enable/disable route through the manager
  (systemctl only for systemd; static reloads the gateway; remote is a no-op);
  platform restart skips non-systemd runners.
- create: a frontend stack (react-vite/supabase) now emits a `runner: static`
  service, not a bare frontend program.

core/tests/test_lifecycle.py

@@ -34,20 +34,17 @@ class TestIsActive:
         config = load_config(castle_root)
         assert lifecycle.is_active("does-not-exist", config) is False
 
-    def test_static_frontend_active_when_dist_built(self, castle_root: Path, tmp_path: Path) -> None:
-        from castle_core.manifest import BuildSpec
+    def test_static_service_active_when_dist_built(self, castle_root: Path, tmp_path: Path) -> None:
+        # A frontend is a `runner: static` service; active once its served dir exists.
+        from castle_core.manifest import ProgramSpec, RunStatic, ServiceSpec
 
         config = load_config(castle_root)
         repo = tmp_path / "fe"
-        config.programs["fe"] = config.programs["test-tool"].model_copy(
-            update={
-                "id": "fe",
-                "behavior": "frontend",
-                "source": str(repo),
-                "build": BuildSpec(commands=[["pnpm", "build"]], outputs=["dist"]),
-            }
+        config.programs["fe"] = ProgramSpec(id="fe", source=str(repo))
+        config.services["fe"] = ServiceSpec(
+            program="fe", run=RunStatic(runner="static", root="dist")
         )
-        # No dist yet → inactive
+        # No dist yet → inactive (caddy manager checks the served dir)
         assert lifecycle.is_active("fe", config) is False
         # Built dist → served in place → active
         (repo / "dist").mkdir(parents=True)