Tools as PATH deployments; demote behavior from lifecycle logic

- manifest: RunPath (runner: path) — a CLI on PATH via `uv tool install`, manager
  = path, no unit/route (like remote/static).
- lifecycle/service: a path deployment's start/stop = install/uninstall (routed
  through activate/deactivate, which skip the reinstall when already on PATH).
  `castle service start/stop <tool>` and status now dispatch by manager; status
  shows the manager tag [systemd|caddy|path|none].
- config.tools() now derives from `runner: path` services, not the behavior label.
- castle-api: the "installed" flag derives from manager==path, not behavior==tool.
- create: a python-cli stack emits a `runner: path` service.

`behavior` no longer drives any runtime logic — it survives only as a display
label + `list --behavior` filter. Verified live: html2text uninstall→reinstall
round-trip via `castle service stop/start`.

core/tests/conftest.py

@@ -42,6 +42,10 @@ def castle_root(tmp_path: Path) -> Generator[Path, None, None]:
             },
         },
         "services": {
+            "test-tool": {
+                "program": "test-tool",
+                "run": {"runner": "path"},
+            },
             "test-svc": {
                 "program": "test-svc-comp",
                 "description": "Test service",

core/tests/test_lifecycle.py

@@ -34,6 +34,28 @@ class TestIsActive:
         config = load_config(castle_root)
         assert lifecycle.is_active("does-not-exist", config) is False
 
+    def test_path_service_checks_path(self, castle_root: Path) -> None:
+        # A `runner: path` service (a tool) is active when on PATH.
+        from castle_core.manifest import ProgramSpec, RunPath, ServiceSpec, manager_for
+
+        assert manager_for("path") == "path"
+        config = load_config(castle_root)
+        config.programs["mytool"] = ProgramSpec(id="mytool", source="/tmp/mytool")
+        config.services["mytool"] = ServiceSpec(program="mytool", run=RunPath(runner="path"))
+        with patch.object(lifecycle, "_on_path", return_value=True) as mock:
+            assert lifecycle.is_active("mytool", config) is True
+        mock.assert_called_once_with("mytool")
+
+    def test_remote_service_is_active(self, castle_root: Path) -> None:
+        # A remote service has no local process; the manager is `none` → available.
+        from castle_core.manifest import RunRemote, ServiceSpec
+
+        config = load_config(castle_root)
+        config.services["ext"] = ServiceSpec(
+            program="ext", run=RunRemote(runner="remote", base_url="http://x")
+        )
+        assert lifecycle.is_active("ext", config) is True
+
     def test_static_service_active_when_dist_built(self, castle_root: Path, tmp_path: Path) -> None:
         # A frontend is a `runner: static` service; active once its served dir exists.
         from castle_core.manifest import ProgramSpec, RunStatic, ServiceSpec