refactor(cams): narrow the Sensing facade — stop exposing executor/deviceController internals

## Problem
(verified) `Sensing` exposes `controller!.executor.state`/`probes` (`lib/blocs/sensing.dart:54-60`) and `SmartPhoneClientManager().deviceController.*` (:68, :79, :83 — note `configure()` correctly uses the new `dataCollectorFactory` name at :122, so whether the `deviceController` getter is deprecated in CAMS 2.x is unverified); chained force-unwraps like `controller!.deployment!` (:224) and `appViewModel.init(Sensing().controller!)` (`lib/blocs/app_bloc.dart:336`) crash on any lifecycle ordering slip. The bloc re-exposes all of it (`app_bloc.dart:149`, :472-474).

## Proposed fix
The facade exposes only what the app consumes (`isRunning`, `deploymentDevices`, `deployment` snapshot, status stream); remove `runningProbes` from the bloc (already listed dead in #597); replace force-unwraps with guarded accessors.

## Acceptance criteria
- [ ] No `executor`/`deviceController` reference outside `sensing.dart`
- [ ] No `!.` on controller/deployment outside guarded facade methods
- [ ] Aligned with #590 (cycle break) and #601

**Effort:** M · **Priority:** P2 · **Change risk:** Medium (touching deployment access paths)