Generalize the focus controller into a harness hosting swappable modes

Loosen AntiDrift's session controller into Keel's general collect→brain→act
loop. A new internal/harness runs at most one mode.Mode at a time, fanning
async completions out to the web SSE and status-bar surfaces.

- internal/mode: the Mode contract (Kind/Command/View/Active) plus optional
  EvidenceConsumer and Expirer ports, and the surfacing Envelope.
- internal/mode/focus: the former session/domain/statemachine packages moved
  under the mode, now satisfying the harness contracts unchanged.
- internal/mode/offscreen: a one-shot away-from-desk mode built on the new
  ai.Proposer, which turns a life-domain brief into one off-screen action.
- cmd/keeld replaces cmd/antidriftd; daemon wires focus + offscreen factories
  with per-mode persistence under ~/.keel/modes/<kind>.
- Finish the rename: KEEL_* env refs in the README, /keeld build artifact
  ignored, stale antidriftd binary removed.

Include the design + implementation plan this refactor was built from under
docs/superpowers/{specs,plans}/2026-06-04-controller-refactor*.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/harness/async_test.go

@@ -0,0 +1,48 @@
+package harness
+
+import (
+	"context"
+	"sync"
+	"testing"
+	"time"
+)
+
+func TestAsyncRunAppliesAndNotifies(t *testing.T) {
+	var mu sync.Mutex
+	notified := make(chan struct{}, 1)
+	a := NewAsync(&mu, func() { notified <- struct{}{} })
+
+	var applied bool
+	a.Run(time.Second,
+		func(ctx context.Context) {},
+		func() bool { return false },
+		func() { applied = true },
+	)
+	select {
+	case <-notified:
+	case <-time.After(time.Second):
+		t.Fatal("notify never fired")
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	if !applied {
+		t.Fatal("apply did not run")
+	}
+}
+
+func TestAsyncRunStaleSkipsApplyAndNotify(t *testing.T) {
+	var mu sync.Mutex
+	a := NewAsync(&mu, func() { t.Fatal("notify fired on stale result") })
+	done := make(chan struct{})
+	a.Run(time.Second,
+		func(ctx context.Context) {},
+		func() bool { close(done); return true },
+		func() { t.Fatal("apply ran on stale result") },
+	)
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("stale guard never evaluated")
+	}
+	time.Sleep(20 * time.Millisecond) // allow a wrongful notify to surface
+}