finish the rebrand: the parts a user reads, and the manifest that was wrong

The extraction landed months ago and the platform side is clean. What was left was
inside the plugin, and it was the half that shows.

── Names a user actually reads ──

The three registered panels were still called "Headscale servers", "Headscale" and
"Headscale" in the panel picker, and the server picker rendered "Headscale" as its
own heading. Those name OUR panels, not the upstream server, so they were simply
missed.

Deliberately NOT a find-and-replace. Most of the ~175 "headscale" strings in here
are correct — "no active Headscale server", "headscale timed out", "is this a
Headscale server?" all refer to the thing this plugin drives, and renaming them
would make the errors lie. What was fixed is the plugin's own identity, plus nine
stale `/headscale` route paths that are wrong rather than merely old (the route is
`/offscale`) and one reference to `queries/headscale.ts`, a file the extraction
deleted.

The console's pty session key moves from `headscale-console-<id>` to
`offscale-console-<id>`. That one has a real cost: a console open at the moment of
the change keeps running in the sidecar under the old key with nothing pointing at
it, until that sidecar restarts. Paid once, deliberately, rather than carrying the
pre-extraction name in persisted state forever.

── The manifest was missing a dependency it has always had ──

`sidecar/ssh.ts` spawns `ssh`, and so does the reachability probe. The manifest
said "Offscale needed nothing", so install checked for nothing and a host without
an ssh client failed at RUNTIME with a spawn error — precisely the failure
`osDependencies` exists to turn into a refusal at install time. PLUGIN.md listed
ssh as a host dependency all along; the manifest was the file that was wrong.

Missed because ssh is on effectively every Linux box, which is also why declaring
it costs nothing there and is the whole difference where it is absent.

── Documentation that said the opposite of the code ──

PLUGIN.md instructed the reader to carry `assist.ts` in "but do not wire it up",
as a marker. It has been wired for some time: `policy.ts` routes
`POST /_officer/policy/assist`, `PolicyView.tsx` renders `<PolicyAssistant />`, and
the manifest declares the route in `readOnlyWrites`. Corrected rather than deleted,
because that instruction is exactly the kind someone would follow — a person
tidying "unused" code would have found it wired and assumed the document knew
something they did not.

Present-tense identifiers corrected to the shipped names; the "before" columns of
the migration tables still say headscale, because that is what they record. A note
at the top says which is which.

tsgo clean, 21 plugin tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

manifest.ts

@@ -33,6 +33,22 @@ export const manifest: PluginManifest = {
   // Worth knowing while it is unfinished: the stored credential is a Headscale ADMIN api key that can
   // delete every node on a tailnet, and there is no read-only version of it — so `write` here is close to
   // full control of the tailnet, which is the owner's decision to make deliberately.
+  // The Console shells into a machine by spawning `ssh` (sidecar/ssh.ts), and so does the reachability
+  // probe behind /ssh-test. This manifest said "Offscale needed nothing" until 2026-08-16, which meant a
+  // host without an ssh client passed the install checks and then failed at runtime with a spawn error —
+  // the one failure mode `osDependencies` exists to convert into a refusal at install time. PLUGIN.md had
+  // listed it as a host dependency all along; the manifest was the file that was wrong.
+  //
+  // Present on effectively every Linux install, which is exactly why it was missed: the declaration costs
+  // nothing on the machines that have it and is the whole difference on the machines that do not.
+  osDependencies: [
+    {
+      binary: 'ssh',
+      reason: 'Opens the Console shell to a machine, and probes reachability before you try.',
+      packages: { apt: 'openssh-client', pacman: 'openssh', dnf: 'openssh-clients', brew: 'openssh' },
+    },
+  ],
+
   permissions: [
     {
       key: 'offscale',