codeSplitters: hosted deploy follow-ups #248

Loose ends from #244:

• Alchemy state: every deploy, desktop or hosted, clones into a fresh directory, so Alchemy starts with empty state. A stack without adopt may try to create resources that already exist. Keep state somewhere durable per repo and stage (R2, or Alchemy's own remote state).
• Key form: while a deploy is running, the Deploy panel redraws every second and would clear a token half-typed into the key form. Leave the form alone while it's being edited.
• Live output: a hosted step's output only arrives when the step finishes (one /exec per command), not as it streams. Stream it, or poll it from the container.
• Key rotation: there's no way to re-seal stored keys under a new DEPLOY_SECRETS_KEY. Rotating it now means every owner has to set their key again.
• More providers: only Cloudflare tokens can be stored. Railway or Hetzner box targets would need their own scoped tokens.

🤖 Generated with Claude Code