v2-platform: 05 gasless publish — wallet delegate action, relayer, on-chain deploy manifest

Parent

#274 (v2 platform services spec)

What to build

Gasless publish: the publish command builds a FastKV write as a wallet-approved delegate action and submits it through the existing ephemeral relayer — no keys on disk, no key-generation CLI rituals for humans. Requires whitelisting the FastKV registry contract in the relayer config and sizing gas/deposit for ~10KB config writes. One transaction writes both the config key and the per-deploy manifest key (the on-chain ledger mirror of the deploy service's records). Terminal wallet signing is a spike with a browser-popup approval fallback — do not block the ticket on the perfect signing UX. The local function-call key path remains first-class for CI and headless agents.

Acceptance criteria

• A human publishes a config to testnet FastKV with a wallet approval and zero locally-stored keys
• The publish transaction writes the config key and the deploy manifest key atomically
• The confirmation loop re-reads the registry and verifies payload equality, as the existing publish flow does
• The relayer whitelist covers the FastKV registry contract with sized gas/deposit limits
• Wallet-approval UX works via browser popup at minimum (terminal-native signing is the spike)
• The existing local-key publish path still works unchanged for CI/agents

Blocked by

• #278 (bos login + bos deploy — publish consumes the deployed config and deployment records)

Start with the existing publish flow and ephemeral relayer, then read the #278 bos login and bos deploy work that supplies the deployed config and records. Trace the FastKV registry write, confirmation loop, and local-key path before assessing wallet approval and relayer configuration. Done means the listed acceptance checks pass without regressing CI or headless-agent publishing.