PR3: add the Worker Command Center and generic roster HUD

[ael-dev3]

Summary

PR3: Worker Command Center and generic-worker world presentation, based exactly on PR2 (#85) agent/generic-castle-workers-v1 at dbddbd687b59b2abc12b197119b58c0b8c4fe05b.

This draft stays additive and fail-closed:

• staged or absent realm_worker_system_v1 keeps the existing legacy expedition HUD and behavior;
• generic mode activates only when the public system declares a coherent four-worker-per-castle roster, all public worker rows are valid, the caller-private roster has exactly four slots, and v2 caller balances decode successfully;
• no seed, activation, backfill, deployment, production mutation, merge, or release is included.

Information architecture

Active generic mode adds a compact W 0/4 control beside the profile trigger with the accessible label “Open workers, N of 4 available”. It opens a bounded, touch-scroll-safe Worker Command Center with four stable roster slots, status, available count, worker selection, individual return, and return-all. Selecting a slot opens a focus-safe Worker Record inspector. The active resource rail reads only v2 available balances and removes the legacy pending/collect affordance. Legacy menu, expedition wagons, and collect-yield controls remain unchanged when the worker system is staged, absent, or invalid.

Backend and privacy boundary

• Player bindings now include only public realm_worker_system_v1, castle_worker_v1, and worker_node_occupation_v1, plus get_my_worker_roster_v1, get_my_resource_state_v2, and the three owner reducers.
• Private assignment, idempotency, scheduler, cargo, and balance tables are not subscribed into the browser.
• Public worker rows carry stable identity/timing/occupation only; caller roster and v2 balances remain procedure-only.
• Commands validate IDs, use retained idempotency keys for ambiguous outcomes, perform no optimistic state changes, and reconcile through fresh private reads.
• Worker targets are a first-class pick lane with priority above castle/resource/terrain targets.

Asset provenance

Restores the reviewed 1024px transparent Worker record art at:
public/images/realm/hegemony-worker-record.webp
(ff758ecbf520b05ccf0a2fa490bcafa6c564514de5ee56ef5a720fd6da24193e). The dated manifest records source authorization, processing, alpha bounds, and the decorative-only boundary. The art supplies no identity, ownership, route, cargo, reward, dispatch, or recall authority.

Validation

• tsc -b --force
• focused Vitest: player binding contract, canonical snapshot, connection, worker presentation, and pick arbitration — 82 tests passing
• vite build
• verify-license-policy.mjs
• verify-castle-worker-additive-migration.mjs
• git diff --check

The full browser/device matrix remains a review follow-up; no live mobile or production environment was changed in this PR.