Remove remaining compliance code from community edition

Found while cutting compliance from the CE tree (Task 10852, PR #7242). Compliance is a paid feature, but these pieces still reach a CE install: 1. Operator Settings knobs for compliance (`compliance_seal_transcript_wait_minutes`, `compliance_seal_epic_wait_minutes`, `compliance_github_credential_id` in apps/api/app/operator_settings/catalog_*.py) still show in CE and do nothing there. Hide a knob whose feature the edition lacks; the knob catalogue needs an edition-feature field for this. 2. The node half of the Architectural Guard (apps/jaahd/guard_bundle.py and its callers in fleet_dispatch.py, clauded_wt.py and cred_broker.py) still ships in the CE node bundle, inert. Move it under the `compliance` feature so it leaves the tree. 3. The CE runner doctrine (apps/api/app/dispatch_compose/doctrine_community.py) still carries the `compliance_auditor` and `merge_lane` role prose, but neither persona can be dispatched in CE any more. Drop that prose, or point it at "not in this edition". 4. On upgrade, an existing CE install can be left with enqueued `compliance_seal`/`compliance_erase` DBOS workflows whose module no longer ships. Cancel them in the CE bootstrap. Out of scope: cloud behaviour; the merge lane and the compliance cut themselves (done in #7242). Done means: - A built CE tree (`build_tree.py` + `check_tree.py`) contains no guard_bundle and no compliance role prose, and the check is green. - On a CE stack, Settings shows no compliance knobs. - A CE boot with a pending compliance_seal workflow leaves none pending.

CE tree has no compliance left. Compliance knobs are hidden and refused via the new Knob.feature field, guard_bundle and its hooks move under compliance, the merge_lane and compliance_auditor doctrine is stubbed, and the CE boot cancels pending cloud-only workflows. #7244 merged (daaf1501), deploy green. Deferred: compliance_fix prose. Memory: none applied.