Public toggle composes for static frontends; document the deployment model

- A static service is inherently exposed, so `public: true` no longer trips the
  "requires proxy" validator — frontends can be public via the tunnel for free
  (the original friction that started this refactor, now resolved).
- docs/registry.md: the manager model (systemd/caddy/path/none), the runner→manager
  table incl. static/path, and behavior as a derived display label.

core/src/castle_core/manifest.py

@@ -324,8 +324,11 @@ class ServiceSpec(BaseModel):
         if self.manage and self.manage.systemd and self.manage.systemd.enable:
             if self.run.runner == "remote":
                 raise ValueError("manage.systemd cannot be enabled for runner=remote.")
-        if self.public and not self.proxy:
-            raise ValueError("public requires proxy (a service must be routed to be exposed).")
+        # A static service is inherently exposed (that's its purpose); other
+        # runners need the proxy checkbox to be routed. Public requires exposure.
+        exposed = self.proxy or self.run.runner == "static"
+        if self.public and not exposed:
+            raise ValueError("public requires the service to be exposed (proxy or static).")
         return self