Derive widget canvas metadata from NODE_SPEC

[d-chambers]

Description

The last structural decoupling item from the architecture review: every bundled widget re-declared the six canvas-metadata attributes (name, description, icon, category, keywords, priority) that its NODE_SPEC already carries. This PR makes the spec the single source:

• ZugWidget.__init_subclass__'s existing spec derivation (_SPEC_DERIVED_ATTRS) now also covers the six metadata fields, filling them in only when the widget class doesn't declare its own — deliberate overrides still work.
• The duplicate declarations are deleted from all 26 widgets (−171 lines). A pre-change sweep imported every derzug.widgets entry point and compared all six fields against the spec: zero mismatches, so nothing canvas-visible changes.
• The shared test_node_spec_consistency now pins all six fields (previously only name), so any future widget/spec drift fails the widget's default test suite.

Also removes the unreachable "unmigrated widget" scaffolding from PatchMethodWidget: with every bundled widget declaring a node_spec + task factory, the generated-params-model fallback and the options_task_factory task built from widget-level method_name/call_style attributes could never run — and the four leftover method_name/call_style attrs on taper/detrend/analytic/ufunc_unary were dead. _OPTIONS subclasses must now declare their own node_spec (enforced with a clear TypeError), and get_task always goes through node_spec.build_task. The Qt-free build_params_model/options_task_factory remain where they belong — used by the node modules themselves.

CHANGELOG updated under Changed (breaking) for the external-subclass contract tightening.

Counterpart review: Codex CLI still rate-limited (resets Aug 8); adversarial self-review record in the untracked .scratch/review_spec_metadata.md (pre-change drift sweep, derivation-order check vs Orange discovery, AST-based deletion validation, and confirmation that the node modules still own the options machinery).

Checklist

I have (if applicable):

• referenced the GitHub issue this PR closes.
• documented new behavior with docstrings and a CHANGELOG entry.
• included tests (test_node_spec_consistency now asserts all six metadata fields across every widget's default suite).
• run prek run --all-files and pytest tests (2114 passed, 44 skipped; all 10 hooks pass — staged before linting this time).
• for hot-path changes, run python scripts/bench_compare.py --baseline main. (n/a — class-creation-time attribute copies; no executed path changes)