bos-auth: 02 gasless wallet publish — bos publish --wallet via NEP-366 relayer

Sprout of #274 (v2 platform services spec); mirrors #282 (gasless publish) with the deploy-service write-back chain decoupled. Built after #288 so the wallet/session surface exists.

What to build

bos publish --wallet submits the FastKV config write as a gasless NEP-366 delegate action through the existing ephemeral relayer:

1. Whitelist the FastKV registry contract in the relayer config and size gas/deposit for ~10 KB config writes.
2. Build the delegate action for set_values of the config key and the per-deploy manifest key atomically in one transaction — the on-chain ledger mirror of the deploy-service records rides the same write.
3. Confirmation loop re-reads the registry and verifies payload equality (same semantics as the current key-based publish flow).
4. The existing local-key publish path stays byte-compatible for CI/agents — --wallet is additive, never a replacement.

Acceptance criteria

• A human publishes a config to testnet FastKV with one wallet approval and zero locally-stored keys
• The relayer whitelist covers the FastKV registry contract with sized gas/deposit limits
• Config key + deploy manifest key are written atomically
• Confirmation re-read verifies payload equality
• The existing NEAR_PRIVATE_KEY publish path still works unchanged
• Failure leaves no partial on-chain state (atomic delegate action)

Blocked by

• #288 (bos login — the wallet/session surface)

Start with the wallet/session surface from #288, then trace the existing bos publish key-based flow and ephemeral relayer configuration. Map where the FastKV config and deploy manifest writes are assembled, and verify the acceptance criteria: one wallet approval, atomic writes, confirmation payload equality, sized relayer limits, and unchanged NEAR_PRIVATE_KEY behavior.