TOML script targets removed; once.toml is now workspace-only

once.toml no longer accepts script targets. It is reserved for workspace configuration, and scripts come exclusively from # once header annotations on script files or from inline script forms. The annotation parser is case-sensitive, so scripts that previously used uppercase # ONCE headers need to be rewritten with lowercase. CI and local guidance now use once exec in place of the removed once run check manifest target.