core: drop pre-migration read-compat now both nodes are current-format

Both machines (civil, primer) are on the current on-disk layout, so the
read-compat for older formats is dead weight. Remove it:

- config loader: only deployments/<kind>/<name>.yaml (drop flat deployments/*.yaml
  and the services/+jobs/ split); drop the run.runner→manager normalizer.
- registry loader: require composite <kind>/<name> keys + manager/kind (registry.yaml
  is regenerated every apply, so it's always current).
- manifest: drop the proxy/public→reach legacy input and the component→program alias
  (the derived proxy/public read accessors stay). reach field defaults already match.
- config_editor: parse incoming specs directly (frontend sends the current shape).
- save_config: drop the flat-file migration cleanup.

Bootstrap seeds move to bootstrap/deployments/<kind>/ and install.sh seeds that
per-kind tree directly. The legacy→current translation for terse test fixtures
moves into each test conftest (out of production). All suites green (362).

install.sh

@@ -351,13 +351,17 @@ seed_control_plane() {
         printf 'repo: %s\n' "$CASTLE_ROOT" >> "${CASTLE_HOME}/castle.yaml"
     fi
 
-    local seeded=0 f dst
+    local seeded=0 f dst rel
     for f in "${CASTLE_ROOT}"/bootstrap/programs/*.yaml; do
         dst="${CASTLE_HOME}/programs/$(basename "$f")"
         [ -f "$dst" ] || { cp "$f" "$dst"; seeded=1; }
     done
-    for f in "${CASTLE_ROOT}"/bootstrap/deployments/*.yaml; do
-        dst="${CASTLE_HOME}/deployments/$(basename "$f")"
+    # Deployments are seeded into the per-kind layout (deployments/<kind>/<name>.yaml),
+    # mirroring bootstrap/deployments/<kind>/ — the shape the loader reads.
+    for f in "${CASTLE_ROOT}"/bootstrap/deployments/*/*.yaml; do
+        rel="${f#"${CASTLE_ROOT}"/bootstrap/deployments/}"
+        dst="${CASTLE_HOME}/deployments/${rel}"
+        mkdir -p "$(dirname "$dst")"
         [ -f "$dst" ] || { sed "s#__SPECS_DIR__#${specs}#g" "$f" > "$dst"; seeded=1; }
     done