Avoid printing partial Render API key during setup-deploy check

**File:** `setup-deploy/SKILL.md` line 851

**Current instruction:**
```
Check for Render API key: `echo $RENDER_API_KEY | head -c 4` (don't expose the full key)
```

The inline comment shows the intent, but the instruction still prints the first 4 characters of the key into terminal scrollback, screen recordings, and screenshots. A presence check would serve the same "is the key available?" purpose without writing any key bytes to stdout.

## Suggested replacement

```bash
if [ -n "${RENDER_API_KEY:-}" ]; then
echo "RENDER_API_KEY: set"
else
echo "RENDER_API_KEY: not set"
fi
```

If a stable fingerprint for cross-run correlation is useful:

```bash
if [ -n "${RENDER_API_KEY:-}" ]; then
printf 'RENDER_API_KEY: sha256:'
printf '%s' "$RENDER_API_KEY" | shasum -a 256 | cut -c1-8
fi
```

(The `:-` guards against `set -u` if the var is unset; `shasum` is macOS-native, `sha256sum` on Linux.)

## Why this is worth the cheap swap

Partial-secret printing tends to get normalized once it ships in a skill doc — downstream users copy the pattern. A four-character prefix may be low severity in isolation, but:
- It still leaks into scrollback, logs, screen shares, and IDE terminal captures
- Many providers use fixed prefixes (`rnd_`, `sk-`, etc.), so the leaked chars are often the non-entropy part anyway
- The presence check achieves the same intent with zero byte leakage

Low-cost hardening, not a severe vuln — happy to send a PR if useful.

---
*Found during a security audit of a Claude Code + Codex + MCP stack. Same class of finding was fixed in our own setup scripts after an adversarial review flagged it.*