feat(core): kind-scoped deployment identity (name, kind)

A deployment's identity becomes (name, kind), so a tool, service, and job can
share a name (a `backup` trio). Kind is structural — which per-kind store / dir —
not a derived discriminator threaded around.

- CastleConfig holds per-kind stores (services/jobs/tools/statics/references);
  all_deployments()/deployments_named()/deployment(kind,name) replace the single
  flat `deployments` dict. A construction-only `deployments` InitVar routes a flat
  map into the stores by kind_for.
- Storage: deployments/<store>/<name>.yaml (per-kind dirs), with read-compat for
  the old flat + services/+jobs/ layouts.
- Registry keyed by composite "<kind>/<name>" + name field; get()/all()/named()/put().
- Job units carry a -job marker (castle-<name>-job.{service,timer}); services and
  everything else unchanged — so a service and a job can coexist.
- deploy/apply/lifecycle thread kind through unit naming, activate/deactivate,
  is_active; caddyfile/tunnel/relations iterate via all_deployments/registry.all.
- Subdomain uniqueness validated across kinds (a service and a static can't share one).

182 core tests pass, incl. a new same-name-trio suite (round-trip, distinct units,
subdomain guard). API/CLI/UI updated in follow-up phases.

core/tests/test_caddyfile.py

@@ -41,7 +41,7 @@ def _make_registry(
     gateway_domain: str | None = None,
     acme_email: str | None = None,
 ) -> NodeRegistry:
-    return NodeRegistry(
+    reg = NodeRegistry(
         node=NodeConfig(
             hostname="test",
             gateway_port=gateway_port,
@@ -49,8 +49,11 @@ def _make_registry(
             gateway_domain=gateway_domain,
             acme_email=acme_email,
         ),
-        deployed=deployed or {},
     )
+    for name, d in (deployed or {}).items():
+        d.name = name
+        reg.put(d)
+    return reg
 
 
 def _dep(port: int, *, expose: bool, name: str | None = None, launcher: str = "python") -> Deployment: