v2-platform: 02 bos login + bos deploy — Zephyr-free build, upload, config write-back

Parent

#274 (v2 platform services spec)

What to build

The developer-facing deploy loop: a login command that stores a platform API key (created via the existing wallet sign-in + Settings UI — no new auth machinery), and a deploy command that builds every workspace Zephyr-free, uploads each dist to the deploy service, and writes the returned URLs + integrity hashes into the config — the same write-back semantics the bundler deploy hooks provide today. After this ticket, the full dev loop (build → upload → config updated) runs against a locally-running platform with zero cloud credentials.

Acceptance criteria

• Login stores a platform API key locally (gitignored) and validates it against the platform
• Deploy builds all local workspaces without invoking any CDN bundler plugin
• Each workspace's upload goes through the deploy service contract and the returned URL + SRI integrity land in the correct config fields
• A failed upload aborts the deploy with a clear per-workspace error, never leaving the config half-written
• Deploying only changed workspaces is supported (incremental deploy)

Blocked by

• #275 (deploy service core)

Start with parent issue #274 and blocker #275, then locate the existing wallet sign-in and Settings key storage plus the current bundler deploy hooks. Verify the login and deploy entry points against the acceptance criteria: Zephyr-free builds, per-workspace uploads, URL and SRI write-back, atomic failure handling, and incremental deployment.