CB-634: one shared "fleet" workspace + rename bridged -> fleetd cutover

Two changes ship together here.

1. One shared herdr workspace. The lead and every worker now live in one
   workspace called "fleet", so the operator sees one "session" with many
   windows, not two. Before, the lead sat in a "leads" workspace and workers
   in "bridged-workers", which read as two sessions. The lead is still told
   apart from workers by its exact tab label ("lead: <name>"), so putting them
   in one space is safe. LeadTabScanner keeps the exclude-by-label mechanism
   for split layouts; Fleetd now passes an empty exclude set.

2. Rename the daemon from "bridged" to "fleetd" (the binary, config, scripts,
   launchd/systemd units, module dir, and MCP mount).
   - Module dir bridged/ -> fleetd/; jar finalName -> fleetd.jar.
   - Log line, comments, docs, and CLAUDE.md updated to say fleetd.
   - Scripts renamed: redeploy-bridged.sh -> redeploy-fleetd.sh,
     bridged-launchd-wrapper.sh -> fleetd-launchd-wrapper.sh.
   - Deploy units renamed: dev.ltms.bridged.plist -> dev.ltms.fleetd.plist,
     bridged.service -> fleetd.service; launchd Label -> dev.ltms.fleetd.
   - Config default bridged.yaml -> fleetd.yaml; the legacy bridged.yaml is
     still read as a fallback, and still gitignored.
   - MCP: drop the deprecated bridge_* tool twins; only fleet_* remain. The
     server name is "fleet". The mount name in the local .mcp.json becomes
     "fleet" (gitignored, not in this commit).
   - Env var defaults BRIDGED_API_TOKEN -> FLEETD_API_TOKEN, fixture
     BRIDGED_WORKER_TOKEN -> FLEETD_WORKER_TOKEN.

Kept on purpose: the BRIDGED_MEMBER marker. Renaming it is a coupled change to
the credential-scrub security control (an operator secrets.sh may guard on it),
so it stays until that migration is done on its own.

Metrics were already fleet_* (CB-632); MetricNamesTest still guards that no
name says bridged_.

The canonical CLAUDE.md block and the wiki template stay byte-identical
(wiki working tree edited, committed to the wiki repo separately).

949 tests pass (mvn clean install). 4 fewer than before = the 4 removed
bridge_* alias tests.

deploy/lavinmq/compose.yaml

@@ -1,8 +1,8 @@
-# LavinMQ — the AMQP broker behind bridged's durable ReplyInbox (CB-307 Stage 2).
+# LavinMQ — the AMQP broker behind fleetd's durable ReplyInbox (CB-307 Stage 2).
 #
 # Why this file exists: the broker was previously run ad hoc and simply vanished from the host,
-# which takes bridged down with it — AmqpReplyInbox.open throws on an unreachable broker and
-# Bridged.java:187 does not guard it, so a missing broker is a hard startup failure, not a
+# which takes fleetd down with it — AmqpReplyInbox.open throws on an unreachable broker and
+# Fleetd.java:187 does not guard it, so a missing broker is a hard startup failure, not a
 # degraded mode. This pins the version, keeps the data, and brings itself back after a reboot.
 #
 # Usage:
@@ -14,27 +14,27 @@
 #
 # Management UI: http://127.0.0.1:15672  (guest / guest)
 #
-# This is bridged's OWN broker. Do not point bridged at any other AMQP server on this host —
+# This is fleetd's OWN broker. Do not point fleetd at any other AMQP server on this host —
 # notably not the `local-rabbitmq` container, which belongs to a different project and would end
 # up carrying this project's queues.
 
-name: bridged-broker
+name: fleetd-broker
 
 services:
   lavinmq:
     # Pinned deliberately: :latest silently moves the broker under a running daemon.
     image: cloudamqp/lavinmq:2.9.1
-    container_name: bridged-lavinmq
+    container_name: fleetd-lavinmq
 
     # The failure this deployment exists to prevent — survive reboots and Docker restarts, but
     # stay down if it was stopped on purpose.
     restart: unless-stopped
 
     # Loopback-bound on purpose. LavinMQ ships a default guest/guest account, which is only
-    # acceptable because nothing off-host can reach it. bridged connects over 127.0.0.1, and
+    # acceptable because nothing off-host can reach it. fleetd connects over 127.0.0.1, and
     # binding 0.0.0.0 here would expose a broker with default credentials to the network.
     ports:
-      - "127.0.0.1:5672:5672"      # AMQP — bridged.yaml broker.uri points here
+      - "127.0.0.1:5672:5672"      # AMQP — fleetd.yaml broker.uri points here
       - "127.0.0.1:15672:15672"    # HTTP management API + UI
 
     # The whole point of Stage 2. Held-but-unacked replies live here; without a named volume a
@@ -57,4 +57,4 @@ services:
 
 volumes:
   lavinmq-data:
-    name: bridged-lavinmq-data
+    name: fleetd-lavinmq-data