chore(deploy): retire the pre-#15610 dist/ compatibility path once every node serves via current #15648

Found while implementing #15610.

What

#15610 moved the SLM frontend's served path from dist/ — a directory that was renamed on every publish — to current, a symlink flipped by a single rename(2). Two compatibility affordances were added so a node mid-migration is never left serving nothing, and both are transitional:

1. roles/_shared/tasks/build_publish_slm_frontend.yml — the task "Frontend: make current resolve before publishing", which adopts a pre-bug(deploy): the SLM frontend promotion is two renames, so the served directory briefly does not exist #15610 dist/ as the first current when no current exists yet.
2. services/frontend_bundle_health.py — bundle_dir() falls back to _LEGACY_BUNDLE_DIR when current is absent, so a not-yet-migrated node keeps being probed instead of silently reporting not_applicable.
3. The leftover dist/ directory itself, which the publish deliberately does not remove: removing it would 403 any host whose nginx config still names it.

The same publish also carries the equivalent seed in services/slm_frontend_build.py (_seed_current_from_legacy_dist) and _LEGACY_DIR.

Why it cannot be done yet

Removing any of them before every node has published under the new layout turns a stale-but-serving host into a 403. The retirement is gated on evidence, not on time.

Acceptance criteria

• Evidence gathered that every node in the fleet serves via current (the site config names it AND current resolves on that host)
• The seed task and _seed_current_from_legacy_dist are removed together with _LEGACY_DIR
• bundle_dir()'s legacy fallback and _LEGACY_BUNDLE_DIR are removed, and the probe reports on current alone
• The leftover dist/ directory is removed from each node by the publish path, not by hand
• The guard test for bug(deploy): the SLM frontend promotion is two renames, so the served directory briefly does not exist #15610 is updated so the removed branches cannot come back unnoticed