feat(cli): register decnet canary subcommand + tests

decnet canary launches the HTTP + DNS callback receiver via
decnet.canary.worker.run. Mirrors the shape of decnet webhook
(typer command with --daemon flag, asyncio.run in the foreground).

Deliberately NOT added to MASTER_ONLY_COMMANDS — every host that
hosts deckies runs its own canary worker, and the bus events stay
local to that host (per-host webhook fanout handles SIEM egress).

decnet/cli/__init__.py

@@ -22,6 +22,7 @@ from . import (
     agent,
     api,
     bus,
+    canary,
     db,
     deploy,
     emailgen,
@@ -58,7 +59,7 @@ for _mod in (
     swarm,
     deploy, lifecycle, workers, inventory,
     web, profiler, orchestrator, emailgen, reconciler, sniffer, db,
-    topology, bus, geoip, init, webhook,
+    topology, bus, geoip, init, webhook, canary,
 ):
     _mod.register(app)