carlos / platform Public

Merge worktree-route-hostnames (#151) — one claim writer, one wire contract

#151's internal/domains claim surface (AttachClaim/DetachClaim/ListClaims,
NormalizeAliasHost, HostDenied, ErrHostUnavailable) supersedes the interim
internal/domainclaim stub, and its /api/cli domains door + carlos domains
CLI pin the wire: POST /domains with a JSON body (200 {host,route,created}),
DELETE /domains/{host} (always-200 {host,removed}), GET rows carrying
status/dns_status/cert_expires_at. Resolved in their favour throughout:

- apimode.go: their apiDomainRecord/domainAttach/domainDetach/domainList
  land; my apiDomain client is folded in — domainAttach grows optional
  kind/channel body fields (deploy's first-route extras), domainList keeps
  the domainListError status wrapper deploy's degrade paths read, and the
  record shape gains the additive guidance field.
- internal/domainclaim is DELETED; the attach/detach core, Settings list
  and every test now speak internal/domains. Same-owner re-attach is now
  idempotent (their titogo contract) instead of a 409; the neutral refusal
  is "hostname unavailable" everywhere; audit + serial gate on an actual
  write (their changed rule).
- domainpolicy.go is DELETED: shape is NormalizeAliasHost, platform space
  is HostDenied over deniedDomains() (origin + apps domain + redirect
  hosts + CONSOLE_DENY_DOMAINS) — one validation spot, both doors.
- their POST handler gains the kind=static first-route branch: an app with
  no ready route short-circuits route resolution into the shared
  attachDomain core (claim + declared static provision record); route and
  kind together are a 400. GET rows compute guidance exactly as the
  Settings page does (domainGuidance, EdgeIPs).
- deploy.go / deploy_test.go adapt to the pinned wire (dns_status,
  POST-body attach, 200-not-201, 'carlos domains list -app' wording).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>