refactor: split internal/delegate/run.go into topical files (pure declaration moves)

changes/unreleased/refactor-split-delegate-run.md

@@ -0,0 +1,5 @@
+### Changed - internal/delegate/run.go split into topical files of the same package
+
+- **What changed.** `internal/delegate/run.go` (8302 lines) is now 14 files of package `delegate` by pure declaration moves: `run.go` keeps the tunables, the `Run`/`RunBatched`/`RunWith` entry points, `attempt`/`runLocal` and the delegation log; the rest moved to `run_types.go`, `run_runner.go`, `run_placements.go`, `run_capacity.go`, `run_wait.go`, `run_replace.go`, `run_retry.go`, `run_localseat.go`, `run_deal.go`, `run_remote.go`, `run_dispatch.go`, `run_accept.go` and `run_probe.go`. No declaration was renamed, reordered inside a body or edited.
+- **Why.** An 8302-line file hid the delegation runner's parts (placement, capacity wait, retry, dealing, dispatch, acceptance, probing) behind one name. The `bare_http_client_allowlist`, the ledger writer list and the delegator-grades-through-`gradeAcceptance` source scan are keyed on `run.go`, so the declarations they read stayed there.
+- **Check.** The census tool (hashes every declaration's source with comments stripped) ran on `internal/delegate` before and after: `diff` of the two outputs is empty and both list 682 declarations. `go build ./...`, `go vet ./internal/delegate`, gofmt, and the delegate, fleetnode, ledger and root changelog/lint tests named for the moved code pass.

docs/systems/delegation-client.md

@@ -101,7 +101,7 @@ then the shorter queue, and names every node it skipped when none can take the j
 | `install_client.go` | `install client`: the config it writes, `hasLocalModel` |
 | `setup/install.sh`, `setup/install.tests.sh` | `--client`, `--remotes`, `--token-file`, and their dry-run tests |
 | `acceptance_cmd.go`, `main.go` (`doctorRun`) | the alias check and the endpoint health line that SKIP with no local model |
-| `internal/delegate/run.go` (`localServesLayer`, `seatless`) | a view that names no agent seat is never a placement |
+| `internal/delegate/run_localseat.go` (`localServesLayer`, `seatless`) | a view that names no agent seat is never a placement |
 | `internal/composeremote/` | `offload_compose_video`'s `route`: node choice, the template and project doors, fetching the outputs back |
 | `internal/composebundle/` | packing a project, and the extract and reference checks both sides run |
 | `internal/fleetnode/compose_project.go` | the node's project door (ADR 0071) |

docs/systems/fleet-node.md

@@ -2298,7 +2298,7 @@ died is still on the node under its job id; the next identical call from that ma
   `pipeline-jobs/` (`.owner`, the writer's process id), the `agent-local-` name prefix and
   `MaxRunLifetime`; `pipeline.RunAgentContract` writes it and the sweep reads it (leaf, standard
   library only)
-- [`internal/delegate/run.go`](../../internal/delegate/run.go) — the delegator: placement, re-placement, the
+- [`internal/delegate/run.go`](../../internal/delegate/run.go) (and its `run_*.go` siblings) — the delegator: placement, re-placement, the
   capacity wait, the spread deal, the dispatch and poll loop (ADR 0063)
 - [`internal/delegate/pin.go`](../../internal/delegate/pin.go) — the closed set of pin reasons, the intake check, a
   hint's route and clause, the pin accounting (ADR 0078)

docs/systems/pair-workloads.md

@@ -24,7 +24,7 @@ pending work on the node that runs it. Off by default; two config keys turn it o
 |---|---|
 | `internal/pairworkloads/pairworkloads.go` | the emitter: PAIR identity from `node-id.json` / `cluster/members.json`, `EngineFor`, `MethodFor`, frame building, `Send` / `Emit` / `EmitSync` (the post that returns when it has been attempted), the ledger observer (`AttachLedger`, `FromLedger`) |
 | `internal/delegate/pairevents.go` | `pairInflight` / `pairTerminal`: the delegation frames and the card identity pinned on `PlacedResult` |
-| `internal/delegate/run.go` | the call sites: `runRemote` (queued; running from the poll loop), `runLocal` (queued; running through `pairStartGate`), `attempt().finish` (terminal); `runner.pair` |
+| `internal/delegate/run_remote.go`, `internal/delegate/run.go`, `internal/delegate/run_runner.go` | the call sites: `runRemote` (queued; running from the poll loop; `run_remote.go`), `runLocal` (queued; running through `pairStartGate`; `run.go`), `attempt().finish` (terminal; `run.go`); `runner.pair` (`run_runner.go`) |
 | `gpu_leasecard.go` | the lease card: `leaseCardIdentity`, `newLeaseCard`, `running`, `finish`; wired into `runGPUReserve` (`gpu_cmd.go`) |
 | `internal/core/workmark.go` | `WithWorkingMark` / `MarkWorking`: the lane's "my work started" signal a call card turns running on |
 | `internal/pairworkloads/calls.go` | running cards for long tool calls: `Begin` (returns the call id), the per-task open-card queue the ledger observer `claim`s from (by call id first), and `CardOutcome`, the one place a finished call becomes a terminal state (*A held card is not a failure*) |