feat(curator): vendor the application backend as the scenario's tracked source

The curator Python backend (package, tests, systemd units, config templates, scripts) now lives under scenarios/curator/backend and is the single source of truth; the live checkout at the workspace path is a runtime copy. Exported from the app repo's tracked tree via git archive (no history, .pi/venv/caches excluded). 149 unit tests pass from the new location.

profile.toml backend is now repo-relative (scenarios/curator/backend); verify-generated.sh resolves a relative backend against REPO_ROOT. verify-no-secrets ASSIGN heuristic now requires value entropy so vendored kwargs like token=extraction_token no longer false-positive. README documents the backend/ layout and the operator-owned app rollout step.

scenarios/curator/profile.toml

@@ -17,10 +17,11 @@ description = "Personal book / film / TV / music curation agent for the Curator
 workspace   = "/home/claw/pi-workspaces/curator"
 session_dir = "/home/claw/.local/share/pi-curator/sessions"
 service     = "curator.service"
-# Application code lives beside the agent's .pi workspace in its own git repo
-# at /home/claw/pi-workspaces/curator. The restricted `read` tool can reach only
-# Markdown under .pi/skills, never the Python backend or credentials.
-backend     = "/home/claw/pi-workspaces/curator"
+# Application code is tracked in this repository under scenarios/curator/backend
+# and is the single source of truth. It deploys to the live workspace root
+# (workspace, above), where .pi/ sits beside it. The restricted `read` tool can
+# reach only Markdown under .pi/skills, never the Python backend or credentials.
+backend     = "scenarios/curator/backend"
 deploy      = "managed"
 
 [model]