refactor(orchestrator): collapse decnet-emailgen.service into orchestrator

Stage 5 of the realism migration. Email generation is no longer a
separate worker / systemd unit / CLI subcommand — the orchestrator's
single tick loop covers SSH traffic, file plants, and email drops.
Going from 21 services to 20.

Worker:
- _one_tick rolls between traffic / file / email (45/45/10 weights).
  The 10% email weight at a 60s orchestrator interval produces ~one
  email per 10 minutes, close to the pre-collapse 5-minute cadence.
- get_driver_for(action) (stage 4) handles SSH vs Email dispatch.
- Quiet branches fall through so a (decky-set, persona-pool,
  mail-decky) shape that silences one branch doesn't waste the tick.
- Periodic prune covers both orchestrator_events and
  orchestrator_emails tables.

Deletions:
- deploy/decnet-emailgen.service.j2
- decnet/orchestrator/emailgen/worker.py
- decnet/cli/emailgen.py
- tests/orchestrator/emailgen/test_worker_integration.py

Renames (history-preserving):
- decnet/web/router/emailgen/ -> decnet/web/router/realism/
- tests/api/emailgen/        -> tests/api/realism/
- tests/cli/test_emailgen_*  -> tests/cli/test_realism_*

Public surface changes (clean break, pre-v1):
- API URL /api/v1/emailgen/personas -> /api/v1/realism/personas
- CLI `decnet emailgen import-personas` -> `decnet realism
  import-personas`. `decnet emailgen run` is gone — the orchestrator
  covers it.
- gating.py: emailgen master-only group replaced by realism.
- decnet-orchestrator.service.j2: DECNET_REALISM_* env block added.
- decnet.target: decnet-emailgen.service entry removed.
- frontend: PersonaGeneration.tsx fetches /realism/personas.

tests/orchestrator/test_worker_integration.py

@@ -73,6 +73,13 @@ async def test_one_tick_records_event_and_publishes(repo, fake_bus, monkeypatch)
 
     monkeypatch.setattr(ssh_driver, "_run", fake_run)
 
+    async def fake_run_with_stdin(argv, stdin_bytes):
+        # plant_file takes the base64-streaming path; treat any docker
+        # exec write as a successful no-op for the integration test.
+        return 0, "", ""
+
+    monkeypatch.setattr(ssh_driver, "_run_with_stdin", fake_run_with_stdin)
+
     received: list = []
 
     async def collect():
@@ -87,8 +94,7 @@ async def test_one_tick_records_event_and_publishes(repo, fake_bus, monkeypatch)
     # Yield once so the subscription is registered before we publish.
     await asyncio.sleep(0)
 
-    driver = ssh_driver.SSHDriver()
-    await orch_worker._one_tick(repo, driver, fake_bus)
+    await orch_worker._one_tick(repo, fake_bus)
 
     await asyncio.wait_for(collector, timeout=2.0)
 
@@ -134,8 +140,14 @@ async def test_one_tick_picks_fleet_deckies(repo, fake_bus, monkeypatch):
 
     monkeypatch.setattr(ssh_driver, "_run", fake_run)
 
-    driver = ssh_driver.SSHDriver()
-    await orch_worker._one_tick(repo, driver, fake_bus)
+    async def fake_run_with_stdin(argv, stdin_bytes):
+        # plant_file takes the base64-streaming path; treat any docker
+        # exec write as a successful no-op for the integration test.
+        return 0, "", ""
+
+    monkeypatch.setattr(ssh_driver, "_run_with_stdin", fake_run_with_stdin)
+
+    await orch_worker._one_tick(repo, fake_bus)
 
     rows = await repo.list_orchestrator_events(limit=10)
     assert len(rows) == 1
@@ -154,8 +166,14 @@ async def test_tick_is_noop_when_no_running_deckies(repo, fake_bus, monkeypatch)
         return 0, "SSH-2.0-foo", ""
 
     monkeypatch.setattr(ssh_driver, "_run", fake_run)
-    driver = ssh_driver.SSHDriver()
-    await orch_worker._one_tick(repo, driver, fake_bus)
+
+    async def fake_run_with_stdin(argv, stdin_bytes):
+        # plant_file takes the base64-streaming path; treat any docker
+        # exec write as a successful no-op for the integration test.
+        return 0, "", ""
+
+    monkeypatch.setattr(ssh_driver, "_run_with_stdin", fake_run_with_stdin)
+    await orch_worker._one_tick(repo, fake_bus)
 
     assert called is False
     assert await repo.list_orchestrator_events(limit=10) == []