feat(org): add OrgChart status legend + CEO delete/terminate guards

Two audit items addressed together because they share the same org-page
render surface and both enforce "read the screen correctly before acting":

1) Status dot colors in OrgChart were undocumented — users saw five
   distinct colors (running/active/idle/paused/error/terminated/
   pending_approval) with no key. Added a compact top-left legend that
   only lists the statuses actually present in the current org, so a
   healthy all-running company shows two rows, not seven. Label copy
   reuses existing agent.form.status* keys (zh/en).

2) The agent Edit modal offered Delete and Status=terminated on every
   agent, including the root (no reportsTo) — the CEO. Deleting or
   terminating a root orphans every direct report. Added `isRootAgent`
   check in EditFormBody:
   - Delete button: disabled, with `rootDeleteBlocked` inline note
     telling the user to reassign reports first.
   - Status select: `terminated` option hidden; `rootTerminateBlocked`
     note explains why.

Scope note: this is UI-level guardrail only. The deleteAgent IPC /
API route is unchanged — same-company power users with DB access can
still do surgical fixes; the board-facing UX just refuses to be a
footgun. Covers J5 / S3 / S4.

src/renderer/i18n/en.ts

@@ -1274,6 +1274,7 @@ export const en: Record<string, string> = {
   "org.zoomIn": "Zoom in",
   "org.zoomOut": "Zoom out",
   "org.fitChart": "Fit chart to screen",
+  "org.statusLegend": "Status",
   "org.agentAria": "{name}, {title}, {status}",
   "org.statusAria": "Status: {status}",
 
@@ -1380,6 +1381,8 @@ export const en: Record<string, string> = {
   "agent.form.statusPaused": "Paused",
   "agent.form.statusError": "Error",
   "agent.form.statusTerminated": "Terminated",
+  "agent.form.rootDeleteBlocked": "Top-of-chain agents cannot be deleted. Reassign their direct reports to another manager first.",
+  "agent.form.rootTerminateBlocked": "Top-of-chain agents cannot be terminated. Reassign their direct reports to another manager first.",
   "agent.form.pendingReadOnly": "Pending hires are read-only here. Use Hiring or Approvals to approve or reject the request before editing the agent profile.",
   "agent.form.saveFailed": "Failed to save agent.",
   "agent.form.wakeFailed": "Failed to wake agent.",

src/renderer/i18n/zh.ts

@@ -1274,6 +1274,7 @@ export const zh: Record<string, string> = {
   "org.zoomIn": "放大",
   "org.zoomOut": "缩小",
   "org.fitChart": "适应画布",
+  "org.statusLegend": "状态",
   "org.agentAria": "{name}，{title}，{status}",
   "org.statusAria": "状态：{status}",
 
@@ -1380,6 +1381,8 @@ export const zh: Record<string, string> = {
   "agent.form.statusPaused": "已暂停",
   "agent.form.statusError": "错误",
   "agent.form.statusTerminated": "已终止",
+  "agent.form.rootDeleteBlocked": "顶层成员无法删除。先把下属重新分配给其他上级。",
+  "agent.form.rootTerminateBlocked": "顶层成员无法终止。先把下属重新分配给其他上级。",
   "agent.form.pendingReadOnly": "待招聘状态为只读。先在招聘或审批里批准或拒绝，再编辑智能体资料。",
   "agent.form.saveFailed": "保存智能体失败。",
   "agent.form.wakeFailed": "唤醒智能体失败。",