feat(core): kind-scoped deployment identity (name, kind)

A deployment's identity becomes (name, kind), so a tool, service, and job can
share a name (a `backup` trio). Kind is structural — which per-kind store / dir —
not a derived discriminator threaded around.

- CastleConfig holds per-kind stores (services/jobs/tools/statics/references);
  all_deployments()/deployments_named()/deployment(kind,name) replace the single
  flat `deployments` dict. A construction-only `deployments` InitVar routes a flat
  map into the stores by kind_for.
- Storage: deployments/<store>/<name>.yaml (per-kind dirs), with read-compat for
  the old flat + services/+jobs/ layouts.
- Registry keyed by composite "<kind>/<name>" + name field; get()/all()/named()/put().
- Job units carry a -job marker (castle-<name>-job.{service,timer}); services and
  everything else unchanged — so a service and a job can coexist.
- deploy/apply/lifecycle thread kind through unit naming, activate/deactivate,
  is_active; caddyfile/tunnel/relations iterate via all_deployments/registry.all.
- Subdomain uniqueness validated across kinds (a service and a static can't share one).

182 core tests pass, incl. a new same-name-trio suite (round-trip, distinct units,
subdomain guard). API/CLI/UI updated in follow-up phases.

core/tests/test_lifecycle.py

@@ -13,26 +13,26 @@ class TestIsActive:
     def test_service_uses_systemctl(self, castle_root: Path) -> None:
         config = load_config(castle_root)
         with patch.object(lifecycle, "_systemctl_active", return_value=True) as mock:
-            assert lifecycle.is_active("test-svc", config) is True
+            assert lifecycle.is_active("test-svc", "service", config) is True
         mock.assert_called_once_with("castle-test-svc.service")
 
     def test_job_uses_timer(self, castle_root: Path) -> None:
         config = load_config(castle_root)
         with patch.object(lifecycle, "_systemctl_active", return_value=True) as mock:
-            assert lifecycle.is_active("test-job", config) is True
-        mock.assert_called_once_with("castle-test-job.timer")
+            assert lifecycle.is_active("test-job", "job", config) is True
+        mock.assert_called_once_with("castle-test-job-job.timer")
 
     def test_tool_checks_path(self, castle_root: Path) -> None:
         config = load_config(castle_root)
         # give the tool a source so the tool branch is reachable
         config.programs["test-tool"].source = "/tmp/test-tool"
         with patch.object(lifecycle, "_on_path", return_value=True) as mock:
-            assert lifecycle.is_active("test-tool", config) is True
+            assert lifecycle.is_active("test-tool", "tool", config) is True
         mock.assert_called_once_with("test-tool")
 
     def test_unknown_is_inactive(self, castle_root: Path) -> None:
         config = load_config(castle_root)
-        assert lifecycle.is_active("does-not-exist", config) is False
+        assert lifecycle.is_active("does-not-exist", "service", config) is False
 
     def test_path_deployment_checks_path(self, castle_root: Path) -> None:
         # A `manager: path` deployment (a tool) is active when on PATH.
@@ -40,9 +40,9 @@ class TestIsActive:
 
         config = load_config(castle_root)
         config.programs["mytool"] = ProgramSpec(id="mytool", source="/tmp/mytool")
-        config.deployments["mytool"] = PathDeployment(manager="path", program="mytool")
+        config.tools["mytool"] = PathDeployment(manager="path", program="mytool")
         with patch.object(lifecycle, "_on_path", return_value=True) as mock:
-            assert lifecycle.is_active("mytool", config) is True
+            assert lifecycle.is_active("mytool", "tool", config) is True
         mock.assert_called_once_with("mytool")
 
     def test_remote_deployment_is_active(self, castle_root: Path) -> None:
@@ -50,10 +50,10 @@ class TestIsActive:
         from castle_core.manifest import RemoteDeployment
 
         config = load_config(castle_root)
-        config.deployments["ext"] = RemoteDeployment(
+        config.references["ext"] = RemoteDeployment(
             manager="none", program="ext", base_url="http://x"
         )
-        assert lifecycle.is_active("ext", config) is True
+        assert lifecycle.is_active("ext", "reference", config) is True
 
     def test_static_deployment_active_when_dist_built(
         self, castle_root: Path, tmp_path: Path
@@ -64,11 +64,11 @@ class TestIsActive:
         config = load_config(castle_root)
         repo = tmp_path / "fe"
         config.programs["fe"] = ProgramSpec(id="fe", source=str(repo))
-        config.deployments["fe"] = CaddyDeployment(
+        config.statics["fe"] = CaddyDeployment(
             manager="caddy", program="fe", root="dist"
         )
         # No dist yet → inactive (caddy manager checks the served dir)
-        assert lifecycle.is_active("fe", config) is False
+        assert lifecycle.is_active("fe", "static", config) is False
         # Built dist → served in place → active
         (repo / "dist").mkdir(parents=True)
-        assert lifecycle.is_active("fe", config) is True
+        assert lifecycle.is_active("fe", "static", config) is True