core: drop pre-migration read-compat now both nodes are current-format

Both machines (civil, primer) are on the current on-disk layout, so the
read-compat for older formats is dead weight. Remove it:

- config loader: only deployments/<kind>/<name>.yaml (drop flat deployments/*.yaml
  and the services/+jobs/ split); drop the run.runner→manager normalizer.
- registry loader: require composite <kind>/<name> keys + manager/kind (registry.yaml
  is regenerated every apply, so it's always current).
- manifest: drop the proxy/public→reach legacy input and the component→program alias
  (the derived proxy/public read accessors stay). reach field defaults already match.
- config_editor: parse incoming specs directly (frontend sends the current shape).
- save_config: drop the flat-file migration cleanup.

Bootstrap seeds move to bootstrap/deployments/<kind>/ and install.sh seeds that
per-kind tree directly. The legacy→current translation for terse test fixtures
moves into each test conftest (out of production). All suites green (362).

core/tests/test_apply.py

@@ -37,7 +37,7 @@ class TestApplyPlan:
     def test_disabled_active_deployment_deactivates(self, castle_root: Path) -> None:
         """A deployment with enabled:false that's currently up → 'deactivate'."""
         # Turn the tool off in config.
-        tool = castle_root / "services" / "test-tool.yaml"
+        tool = castle_root / "deployments" / "tools" / "test-tool.yaml"
         tool.write_text(tool.read_text() + "enabled: false\n")
 
         result = _plan(castle_root, active={"test-tool": True})
@@ -47,7 +47,7 @@ class TestApplyPlan:
 
     def test_disabled_inactive_is_unchanged(self, castle_root: Path) -> None:
         """enabled:false and already down → nothing to do."""
-        tool = castle_root / "services" / "test-tool.yaml"
+        tool = castle_root / "deployments" / "tools" / "test-tool.yaml"
         tool.write_text(tool.read_text() + "enabled: false\n")
 
         result = _plan(castle_root, active={})