feat(workers): surface clusterer, campaign-clusterer, reconciler in panel

The Workers panel (Config → Workers tab) hardcodes its row list in
KNOWN_WORKERS — by design, so a rogue publisher can't inject UI rows.
Three heartbeat-emitting workers were missing:

  * clusterer            — behavioral clustering (decnet/clustering/)
  * campaign-clusterer   — campaign assembly  (decnet/clustering/campaign/)
  * reconciler           — host-local fleet convergence (added in 430262e)

Each already publishes on system.<name>.health via run_health_heartbeat,
so they show up live the moment they're added to the registry — no
frontend or subscriber wiring needed (Config.tsx renders whatever
/workers returns).

Also added to _PREFERRED_ORDER in start-all so START ALL WORKERS brings
them up in dependency-friendly order: data-plane → reconciler → intel
→ clustering → output → orchestrator.

Three deployable units (listener, web, swarmctl) intentionally remain
absent from KNOWN_WORKERS — they don't emit heartbeats (CLI / static
server / one-shot tooling), so they'd permanently render as UNKNOWN
and confuse operators.  Adding them is a separate decision that needs
a "synthesize installed-but-silent rows" pass on the registry.

decnet/web/router/workers/api_start_all_workers.py

@@ -25,8 +25,11 @@ _PREFERRED_ORDER: tuple[str, ...] = (
     "sniffer",
     "prober",
     "mutator",
+    "reconciler",
     "reuse-correlator",
     "enrich",
+    "clusterer",
+    "campaign-clusterer",
     "webhook",
     "orchestrator",
 )

decnet/web/worker_registry.py

@@ -38,8 +38,11 @@ KNOWN_WORKERS: tuple[str, ...] = (
     "sniffer",
     "prober",
     "mutator",
+    "reconciler",  # host-local fleet convergence — JSON ↔ DB ↔ docker
     "reuse-correlator",  # credential-reuse pass — bus-woken on credential.captured
     "enrich",     # threat-intel enrichment — bus-woken on attacker.observed/scored
+    "clusterer",  # behavioral clustering — bus-woken on attacker.scored
+    "campaign-clusterer",  # campaign assembly — bus-woken on identity.formed
     "webhook",    # external SIEM/SOAR egress — bus consumer → HMAC HTTP POSTs
     "orchestrator",  # synthetic life-injection — inter-decky traffic + file ops
     "agent",