Take the operator CLI from instrumentctl

[mikelangmayr]

• The CLI was 1100 lines of deployment logic with hispec's names spelled through it. Those names now come from src/hispec/cli/instrument.toml, and the logic moved to instrumentctl, a dependency shared with other instruments.
• What stays here is 62 lines: the config, a shim that passes it, and python -m hispec.cli. 1271 lines leave.
• [project.scripts] hispec = "hispec.cli:main" is unchanged, so install.sh, the polkit rule and the /usr/local/bin wrapper need no edits.
• The shim passes repo_hint, which matters: the old code found the checkout by walking up from __file__, and once the walk starts in site-packages every host silently falls back to /opt/hispec/app. The instrument is what knows where it lives.
• requires-python moves to >=3.11, since instrumentctl uses stdlib tomllib. The deployment venv runs 3.14.
• Which credentials a host needs is still derived from the deployed configs and the daemon code, not configured. A hand-written list is what went stale in install.sh before.
• The pre-rename hispec-daemon@ unit and polkit rule move into a [legacy] section, so that history travels with this instrument rather than with the shared code.
• Verified end to end: uv sync pulls instrumentctl from git, and the installed hispec console script runs deploy, status, logs and doctor against a fixture host tree with output identical to before. Separately proven generic by driving the same code from a four-line lris2 config.
• Docs updated where they named src/hispec/cli/ as the CLI's home.

[prkrtg]

Hmm, I'm thinking because of this change it might be better to split out now to a generic code base.

We can move everything in cli/ into its own package (instrumentctl?). It'll depend on nothing instrument-specific. And when each instrument depends on it, ships its own instrument.toml, and declares its own console script (hispec = "instrumentctl:main").

[mikelangmayr]

@prkrtg Done in this PR, and instrumentctl is up at: https://github.com/CaltechOpticalObservatories/instrumentctl

One deviation: the console script stays hispec.cli:main rather than instrumentctl:main.

[prkrtg]

Looks great!