refactor(cli): resource-first command surface

Names collide across resource types (a program and a service can share a name),
so the CLI no longer resolves bare names. Operations live under the resource
they act on; platform lifecycle and the cross-resource overview stay top-level.

  castle program  list|info|create|add|clone|delete|run|install|uninstall|
                  build|test|lint|format|type-check|check
  castle service  list|info|create|delete|deploy|enable|disable|start|stop|restart|logs
  castle job      <same verbs>   (create takes --schedule)
  castle gateway  start|stop|reload|status
  castle list | status | deploy [name]        # cross-cutting
  castle start | stop | restart               # whole platform (systemd verbs)

Key changes:
- info/delete/list/run are resource-scoped (no more cross-section name match).
- delete only removes the named resource's entry; program delete still blocks
  when a deployment references it.
- per-resource start/stop/restart (systemctl on the unit/timer); top-level
  start/stop/restart act on the whole platform.
- expose → 'service create' (more general: --program ref, --runner); gained
  'job create' (the CLI never had one).
- dropped up/down — bringing things online is the honest 'deploy && start'.

Docs (CLAUDE.md, registry.md, stack guides) and user-facing messages updated.
core 94 / cli 24 / api 52 green; ruff clean. Verified live: program/service/job
list+info scope correctly, service create+scoped-delete round-trips.

cli/src/castle_cli/commands/info.py

@@ -32,14 +32,16 @@ def run_info(args: argparse.Namespace) -> int:
     """Show detailed info for a program, service, or job."""
     config = load_config()
     name = args.name
+    resource = getattr(args, "resource", None)
 
-    # Look up in all sections
-    program = config.programs.get(name)
-    service = config.services.get(name)
-    job = config.jobs.get(name)
+    # Look up in the requested section (or all, when unscoped).
+    program = config.programs.get(name) if resource in (None, "program") else None
+    service = config.services.get(name) if resource in (None, "service") else None
+    job = config.jobs.get(name) if resource in (None, "job") else None
 
     if not program and not service and not job:
-        print(f"Error: '{name}' not found in castle.yaml")
+        where = f" {resource}" if resource else ""
+        print(f"Error: no{where} '{name}' in castle.yaml")
         return 1
 
     deployed = _load_deployed_program(name)