[codex] Make substrate the source default profile

[8Dionysus]

Summary

• make substrate the source-owned default runtime profile for storage plus orchestration
• add local-worker as the explicit llama.cpp plus langchain-api worker layer
• keep core as a compatibility bundle while updating docs, CI rehearsal, validators, systemd skeleton, and the decision record

Why

abyss-stack should own the real working AbyssOS substrate from source without silently selecting model workers, federation, tools, or observability. Richer live runtime shapes remain explicit profile or preset choices.

Validation

• python scripts/release_check.py
• python scripts/validate_stack.py
• python scripts/validate_decision_records.py
• python scripts/validate_nested_agents.py
• python -m pytest -q
• shellcheck scripts/aoa-lib.sh
• systemd-analyze --user verify systemd/user/podman-compose-abyss.service
• source profile render checks for substrate, local-worker, substrate+local-worker, and core
• synthetic runtime bootstrap/check-layout/render checks for substrate and local-worker

Runtime note

This changes the source-owned default and checked-in unit skeleton. It does not mutate live /srv/AbyssOS/abyss-stack state or host-local user-unit drop-ins.