fix: make Agent Spec placement path-independent

[myobie]

Summary

• make an explicit Agent Spec identity + host pair authoritative independent of declaration path while preserving path defaults and mismatch diagnostics when either field is omitted
• discover declarations recursively through ordinary organizational and dot-prefixed folders, with exclusions scoped to .git/.st2 control directories, the catalog-root PTY registry, and state directories owned by an actual declaration
• share the catalog-space predicate with the supervisor watcher and record the boundary in the root VRS

Contract

• moving a fully explicit declaration does not change its resolved identity or host
• the declaration parent remains the state/resource and edit anchor
• .managed, .retired, and nested project folders named archive, resources, or inbox carry no implicit lifecycle/control meaning
• .git and .st2 are excluded at every hierarchy depth so nested repositories/control state cannot expose declarations
• pty is excluded only at the catalog root; resources, archive, and inbox are excluded only as children of an actual declaration parent
• partial declarations retain the existing path-derived defaults and mismatch warnings
• duplicate resolved bus IDs remain validation errors

Verification at 0872e53a6aa3c4d1b356981faf91279a57821cf8

• hosted nix flake check --print-build-logs: PASS
  • run: https://github.com/compoundingtech/st2/actions/runs/30550351972
  • job: https://github.com/compoundingtech/st2/actions/runs/30550351972/job/90897097004
• cargo test -p agent-spec --test discovery -- --test-threads=1: PASS (27/27)
• cargo test --test validate -- --test-threads=1: PASS (32/32)
• cargo test --lib watch::tests -- --test-threads=1: PASS (3/3)
• cargo test --workspace --all-targets -- --test-threads=1: PASS
• cargo clippy --workspace --all-targets -- -D warnings: PASS
• cargo doc --workspace --no-deps: PASS (five unchanged pre-existing warnings)
• git diff --check origin/main: PASS

Review correction

• excludes nested .git and .st2 paths in both discovery and watcher classification
• keeps pty root-only, declaration state directories contextual, and all other dot folders ordinary
• rebased onto live main ce2c1069f2a59fd50a0ca1d56346e103db666ed2, preserving PR feat(agent-spec): add typed Resource bindings #86 resource bindings

No live catalog, supervisor, service, or PTY state was mutated.

Closes #88
Closes #90