core: drop pre-migration read-compat now both nodes are current-format

Both machines (civil, primer) are on the current on-disk layout, so the
read-compat for older formats is dead weight. Remove it:

- config loader: only deployments/<kind>/<name>.yaml (drop flat deployments/*.yaml
  and the services/+jobs/ split); drop the run.runner→manager normalizer.
- registry loader: require composite <kind>/<name> keys + manager/kind (registry.yaml
  is regenerated every apply, so it's always current).
- manifest: drop the proxy/public→reach legacy input and the component→program alias
  (the derived proxy/public read accessors stay). reach field defaults already match.
- config_editor: parse incoming specs directly (frontend sends the current shape).
- save_config: drop the flat-file migration cleanup.

Bootstrap seeds move to bootstrap/deployments/<kind>/ and install.sh seeds that
per-kind tree directly. The legacy→current translation for terse test fixtures
moves into each test conftest (out of production). All suites green (362).

bootstrap/deployments/services/castle-api.yaml

@@ -0,0 +1,18 @@
+program: castle-api
+description: Castle API
+manager: systemd
+run:
+  launcher: python
+  program: castle-api
+expose:
+  http:
+    internal:
+      port: 9020
+    health_path: /health
+reach: internal
+manage:
+  systemd: {}
+defaults:
+  env:
+    CASTLE_API_PORT: ${port}
+    CASTLE_API_DATA_DIR: ${data_dir}

bootstrap/deployments/services/castle-gateway.yaml

@@ -0,0 +1,22 @@
+# The Caddy gateway. `__SPECS_DIR__` is substituted with $CASTLE_HOME/artifacts/specs
+# at install time (install.sh seed_control_plane). For acme TLS, add a
+# CLOUDFLARE_API_TOKEN to defaults.env later — see docs/dns-and-tls.md.
+description: Caddy reverse proxy gateway
+manager: systemd
+run:
+  launcher: command
+  argv:
+  - caddy
+  - run
+  - --config
+  - __SPECS_DIR__/Caddyfile
+  - --adapter
+  - caddyfile
+expose:
+  http:
+    internal:
+      port: 9000
+    health_path: /
+manage:
+  systemd:
+    exec_reload: caddy reload --config __SPECS_DIR__/Caddyfile --adapter caddyfile