feat(repo): deploy the site from one command

[systemfsoftware-maker]

Lake 1, U12, stacked on #52. Trimmed per Kiro's 2026-10-06 ruling: no deployed-trace journey, no hard-coded domain.

• pnpm run deploy deploys the Worker with Alchemy to the adopter's own Cloudflare account; the stage is ALCHEMY_STAGE (default prod). pnpm run destroy refuses to run without an explicit stage. Bare pnpm deploy is pnpm's built-in command, so the README says pnpm run deploy.
• bin/cloud runs both inside the sandbox, the one place the Cloudflare credentials enter it, allowed to reach only api.cloudflare.com and *.workers.dev (alchemy's state store), with telemetry off.
• alchemy.run.ts: prod and pr-<N> keep state in Cloudflare.state(); every other stage, pnpm dev included, keeps Alchemy.localState() and needs no credentials. A production domain is adopter configuration: SITE_DOMAIN, read on the prod stage only. The stack outputs url and workerName.
• README "Deploy" section; AGENTS.md: the template holds no credentials, and a job that needs one carries if: ${{ !github.event.repository.is_template }}.

Removed by the trim: the deployed-trace journey and its Workers Observability fixture, @distilled.cloud/cloudflare, the cf-ray field, and endgame.systemfsoftware.com.

Gate at 4747829

$ pnpm check:ci
checkci=1        # only check:sfs-sources, inherited from #52; format, 8/8 turbo tasks, build and the sandbox proofs pass
$ pnpm journeys
journeys=0

Not exercised here: a real deploy. The template has no credentials by design; the first one runs in an adopter's copy.