Extract RSI controller slices: candidates, fleet, integrity, proof (#126)

[w4ffl35]

Finishes the controller extraction for #126 (finish session; no new scope).

What changed:

• Extracts candidate/fleet/integrity/proof helpers out of src/rsi/controller.ts into controller-candidates / controller-fleet / controller-integrity(-seal) / controller-proof-{manifest,archive} modules with re-exports from controller.ts (no behavior change).
• Adds 3 slice test files: controller-candidates, controller-fleet-results, controller-integrity (all pass standalone).
• Minimal finish-session fixes (test-only): ResourceClass 'cpu' -> 'CPU' in controller-candidates.test.ts; FleetJobPayload import moved from types.js to postgres-queue.js in controller-fleet-results.test.ts.
• Regenerates code-standards + architecture baselines in the same change (moved lines only; no new style debt introduced).

Gates (honest):

• npx tsc --noEmit: GREEN.
• npm run check-standards: GREEN (after baseline regen for moved lines).
• npm run check-architecture: GREEN (after baseline regen for moved lines).
• npm test (full): NOT green — 1 failure in src/orchestrator/tests/cleanup.test.ts testApplySyncsMainToOrigin (push-sync hash mismatch). Verified PRE-EXISTING by stashing this diff and re-running on clean master (still fails there); unrelated to this RSI slice. All RSI tests incl. the 3 new files pass.
• npm run coverage -- --min 24: threshold EXCEEDED (58.96% lines) but command exits 1 because it inherits the same pre-existing cleanup test failure via run-tests fail-fast.

Shippable partial per the finish brief: extraction is committed and reviewable; the single red gate is pre-existing on master and outside this diff's scope.