Generalize the focus controller into a harness hosting swappable modes

Loosen AntiDrift's session controller into Keel's general collect→brain→act
loop. A new internal/harness runs at most one mode.Mode at a time, fanning
async completions out to the web SSE and status-bar surfaces.

- internal/mode: the Mode contract (Kind/Command/View/Active) plus optional
  EvidenceConsumer and Expirer ports, and the surfacing Envelope.
- internal/mode/focus: the former session/domain/statemachine packages moved
  under the mode, now satisfying the harness contracts unchanged.
- internal/mode/offscreen: a one-shot away-from-desk mode built on the new
  ai.Proposer, which turns a life-domain brief into one off-screen action.
- cmd/keeld replaces cmd/antidriftd; daemon wires focus + offscreen factories
  with per-mode persistence under ~/.keel/modes/<kind>.
- Finish the rename: KEEL_* env refs in the README, /keeld build artifact
  ignored, stale antidriftd binary removed.

Include the design + implementation plan this refactor was built from under
docs/superpowers/{specs,plans}/2026-06-04-controller-refactor*.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/mode/focus/statemachine/statemachine_test.go

@@ -0,0 +1,54 @@
+package statemachine
+
+import (
+	"testing"
+
+	"keel/internal/mode/focus/domain"
+)
+
+func TestPlanningActivatesOnlyWithAcceptedPolicy(t *testing.T) {
+	got, err := TransitionRuntime(domain.RuntimePlanning, ActivateAccepted)
+	if err != nil || got != domain.RuntimeActive {
+		t.Fatalf("accepted: got %s err %v", got, err)
+	}
+	_, err = TransitionRuntime(domain.RuntimePlanning, ActivateRejected)
+	if err == nil {
+		t.Fatalf("rejected policy should error")
+	}
+}
+
+func TestActiveCanCompleteForReview(t *testing.T) {
+	got, err := TransitionRuntime(domain.RuntimeActive, CompleteForReview)
+	if err != nil || got != domain.RuntimeReview {
+		t.Fatalf("got %s err %v", got, err)
+	}
+}
+
+func TestReviewEndsToLocked(t *testing.T) {
+	got, err := TransitionRuntime(domain.RuntimeReview, EndWorkPeriod)
+	if err != nil || got != domain.RuntimeLocked {
+		t.Fatalf("got %s err %v", got, err)
+	}
+}
+
+func TestLockedCannotBecomeActiveDirectly(t *testing.T) {
+	_, err := TransitionRuntime(domain.RuntimeLocked, ActivateAccepted)
+	if err == nil {
+		t.Fatalf("locked->active must be illegal")
+	}
+}
+
+func TestCommitmentDraftActivatesAndViolatedRecovers(t *testing.T) {
+	got, err := TransitionCommitment(domain.CommitmentDraft, CommitmentActivate)
+	if err != nil || got != domain.CommitmentActive {
+		t.Fatalf("draft->active: got %s err %v", got, err)
+	}
+	got, err = TransitionCommitment(domain.CommitmentViolated, RecoverExplicitly)
+	if err != nil || got != domain.CommitmentActive {
+		t.Fatalf("violated->active: got %s err %v", got, err)
+	}
+	_, err = TransitionCommitment(domain.CommitmentViolated, ReturnFromPause)
+	if err == nil {
+		t.Fatalf("violated->returnFromPause must be illegal")
+	}
+}