Expose external root bridges through daemon and CLI

[salmonumbrella]

What changed

• add connector administration and external-root bridge endpoints to the daemon API and generated Go client
• add kata connector status/field-mapping commands and the full kata bridge bind/show/pause/resume/unbind/reconcile lifecycle
• start reconciliation and event wake workers only when at least one connector is configured

User-facing boundaries

The external root owns bound title and body. Inbound comments and lifecycle are enabled by default; outbound comments require --publish-comments. Planning mappings support scheduled_on and deadline_on only.

No web UI binding indicator is included in this series. Connector and bridge status are available through the daemon API and CLI.

Scope and dependency

This is PR 4 of the delivery sequence tracked in #286 and depends on #287, #291, and #292. The branch is cumulative so it builds before those PRs merge; after they land, the review diff narrows to daemon/API/CLI integration.

Closes #286.

[roborev-ci]

roborev: Combined Review (48dafbb)

The PR has one medium-severity reconciliation correctness issue; no critical or high-severity findings were reported.

Medium

• internal/rootbridge/reconciler.go:476 — If a connector loses its fields capability after field mappings are configured, reconciliation silently skips all mapped fields while recording success. This allows bridge drift while last_success_at continues advancing.
  • Suggested fix: Return ErrFieldSynchronizationUnavailable, or persist/pause reconciliation with a field conflict when active mappings exist but the capability is unavailable.

---

Reviewers: 2 done | Synthesis: codex, 8s | Total: 31m8s