codeSplitters: deploy for real, on a button or on a human merge to main #210

Builds on #205, which only deploys a preview stage and then destroys it.

• Deploy menu (owner only): pick the target stage and turn "deploy on merge to main" on or off.
• Only humans trigger it: the owner presses Deploy, or a merge to main is made by a human. A merge by an agent-* handle, including the dependency doctor's deps-* branches, never deploys.
• Same runner as codeSplitters: a preview deploy you watch go green, step by step #205: clone, bun install, rustybuns deploy --yes --stage <stage>, check the URL, delete the clone. Nothing is destroyed afterwards. Refuse targets.edge.adopt stacks unless the owner confirms it is production.
• Deploy log in D1 (today codeSplitters: a preview deploy you watch go green, step by step #205's runs live only in memory): who triggered it, which commit, which stage, the result, the URL and the log tail. Show it on the repo page.
• Desktop first, using the logins on this machine. Hosted deploys are a separate issue (stored keys).

🤖 Generated with Claude Code