[iamnbutler]

Makes Cloudflare one way to host Ace's cells instead of the only one. `services/celld.ts` runs `celld dev` or `celld deploy` for the channel or directory service from its existing `wrangler.jsonc`:

• It drops `observability`, which celld refuses.
• It sets the deployment's vars from a file, because celld has no secret store.
• It bundles with wrangler's esbuild.

`docs/setup.md` covers deploying to a bucket, running one node per service, and serving it over `tailscale serve`. The architecture table now says "Cloudflare or celld". Compute stays Cloudflare-only.

Hosted channels need the fix for denoland/celld#277. Without it, every run's first commit fails with "Session is poisoned". Until that issue is fixed upstream, the docs install the githubnext/celld build that carries the fix. `failure()` now logs an error's `cause`, which is how the real failure behind "poisoned" showed up.

Tested in fleet mode against an Azure Blob emulator, using the patched celld:

• The directory and channel services were deployed through `services/celld.ts` and each ran on its own node.
• An isolated host joined the directory and created a hosted channel, which ran a model turn with workspace tools (`git log`).
• No harness errors.

Built in Ace

No. This was built with Claude Code in a terminal: the session began as research into hosting providers, outside Ace, and continued there. Patching and releasing celld also happened outside Ace, in a clone of the fork. Tracked under #5.