feat: muse is the shipped default template

[OndrejDrapalik]

Summary

• [sandbox] template defaults to muse (Meta's Muse Code) instead of base. A new box with nothing configured boots an agent ready to work rather than an empty image to install one into. base stays in the picker (last row), stays the create-time fallback for a template that is not built on the cluster, and [sandbox] template = "base" restores the old behaviour.
• fleetTemplateChoices no longer drops whatever [sandbox] template names; it drops agentless templates: base, or anything mapped to "" in [fleet.agents] (the documented control-arm / own-plain-image switch). With the default now an agent, the old rule would have removed muse from every roster.
• Tests: the fleet roster test covers base excluded, a ""-mapped plain image excluded, an unmapped one kept, and muse (the default) kept. cli.test.sh asserts a bare run with an empty config resolves muse and its muse exec command, and refuses -t base by name.
• Docs: config.example.toml, README picker example and prose, docs/headless-run.md, CHANGELOG (Changed).

Test plan

• node --test: 372 pass (the dashboard-launcher minimal-PATH flake is the known one)
• bash test/cli.test.sh: 323 passed
• HERDR_PLUGIN_CONFIG_DIR=<empty> node src/resolve-template.js "" → ask muse, menu muse, claude, codex, …, base
• … --fleet → claude codex opencode amp grok droid prime muse (base gone, muse present)
• Live: e2b-box open in a checkout with no [sandbox] template, Enter, box boots muse