feat(org): add OrgChart status legend + CEO delete/terminate guards

Two audit items addressed together because they share the same org-page
render surface and both enforce "read the screen correctly before acting":

1) Status dot colors in OrgChart were undocumented — users saw five
   distinct colors (running/active/idle/paused/error/terminated/
   pending_approval) with no key. Added a compact top-left legend that
   only lists the statuses actually present in the current org, so a
   healthy all-running company shows two rows, not seven. Label copy
   reuses existing agent.form.status* keys (zh/en).

2) The agent Edit modal offered Delete and Status=terminated on every
   agent, including the root (no reportsTo) — the CEO. Deleting or
   terminating a root orphans every direct report. Added `isRootAgent`
   check in EditFormBody:
   - Delete button: disabled, with `rootDeleteBlocked` inline note
     telling the user to reassign reports first.
   - Status select: `terminated` option hidden; `rootTerminateBlocked`
     note explains why.

Scope note: this is UI-level guardrail only. The deleteAgent IPC /
API route is unchanged — same-company power users with DB access can
still do surgical fixes; the board-facing UX just refuses to be a
footgun. Covers J5 / S3 / S4.

src/renderer/i18n/en.ts

@@ -1274,6 +1274,7 @@ export const en: Record<string, string> = {
   "org.zoomIn": "Zoom in",
   "org.zoomOut": "Zoom out",
   "org.fitChart": "Fit chart to screen",
+  "org.statusLegend": "Status",
   "org.agentAria": "{name}, {title}, {status}",
   "org.statusAria": "Status: {status}",
 
@@ -1380,6 +1381,8 @@ export const en: Record<string, string> = {
   "agent.form.statusPaused": "Paused",
   "agent.form.statusError": "Error",
   "agent.form.statusTerminated": "Terminated",
+  "agent.form.rootDeleteBlocked": "Top-of-chain agents cannot be deleted. Reassign their direct reports to another manager first.",
+  "agent.form.rootTerminateBlocked": "Top-of-chain agents cannot be terminated. Reassign their direct reports to another manager first.",
   "agent.form.pendingReadOnly": "Pending hires are read-only here. Use Hiring or Approvals to approve or reject the request before editing the agent profile.",
   "agent.form.saveFailed": "Failed to save agent.",
   "agent.form.wakeFailed": "Failed to wake agent.",