core: drop pre-migration read-compat now both nodes are current-format

Both machines (civil, primer) are on the current on-disk layout, so the
read-compat for older formats is dead weight. Remove it:

- config loader: only deployments/<kind>/<name>.yaml (drop flat deployments/*.yaml
  and the services/+jobs/ split); drop the run.runner→manager normalizer.
- registry loader: require composite <kind>/<name> keys + manager/kind (registry.yaml
  is regenerated every apply, so it's always current).
- manifest: drop the proxy/public→reach legacy input and the component→program alias
  (the derived proxy/public read accessors stay). reach field defaults already match.
- config_editor: parse incoming specs directly (frontend sends the current shape).
- save_config: drop the flat-file migration cleanup.

Bootstrap seeds move to bootstrap/deployments/<kind>/ and install.sh seeds that
per-kind tree directly. The legacy→current translation for terse test fixtures
moves into each test conftest (out of production). All suites green (362).

castle-api/tests/test_kind_twins.py

@@ -21,15 +21,17 @@ from castle_core.config import load_config
 # so the trio passes subdomain-uniqueness validation.
 _SVC = {
     "program": "backup",
-    "run": {"runner": "python", "program": "backup"},
+    "manager": "systemd",
+    "run": {"launcher": "python", "program": "backup"},
     "manage": {"systemd": {}},
 }
 _JOB = {
     "program": "backup",
-    "run": {"runner": "command", "argv": ["backup"]},
+    "manager": "systemd",
+    "run": {"launcher": "command", "argv": ["backup"]},
     "schedule": "0 3 * * *",
 }
-_TOOL = {"program": "backup", "run": {"runner": "path"}}
+_TOOL = {"program": "backup", "manager": "path"}
 
 
 def _put(client: TestClient, section: str, name: str, cfg: dict) -> None: