[IDE] deploy runs invalid setup lookup and --dry-run still updates actions

[miki3421]

• I have searched the issues and believe this is not a duplicate.

Issue description

`ops ide deploy` has two related problems in the IDE deploy workflow:

1. The post-deploy `setup` hook always runs `ops action list setup`, even when the project has no `setup` package. The positional argument is not interpreted as “list actions in the current namespace's setup package”, and the command reports an error for namespace `default`.
2. `ops ide deploy --dry-run` still executes `ops package update` and `ops action update`. The flag is parsed and stored, but the deploy implementation never checks it before running mutating commands.

The behavior is present in both:

• `apache/openserverless-task:0.9.1` setup task
• `apache/openserverless-task:0.9.1` unconditional post-deploy hook
• `apache/openserverless-task:0.9.1` dry-run state
• `apache/openserverless-task:0.9.1` action update
• `nuvolaris/bestia:bestia`, where the same implementation is present. That repository has GitHub Issues disabled.

Observed behavior

With a valid login and a project that has no local or remote `setup` package:

```sh
ops ide deploy --dry-run
```

The command performs real package/action updates and ends with:

```text
ops action list setup
error: Unable to obtain the list of actions for namespace 'default':
The requested resource does not exist.
```

The overall deploy still exits with code 0 because the failing command is the first stage of a pipeline whose final `while` loop succeeds.

Expected behavior

• `--dry-run` must not update packages, actions, projects, or invoke post-deploy setup actions.
• A project without a `setup` package must finish silently without a false error.
• If listing actions genuinely fails, the task should propagate the failure instead of hiding it behind the pipeline.
• Setup actions, when present, should be selected from the authenticated namespace rather than by passing `setup` as a namespace argument.

Minimal reproduction

1. Log in to a valid namespace.
2. Use any OPS project with `packages/` but without `packages/setup/`.
3. Run:
   ```sh
   ops ide deploy --dry-run
   ```
4. Observe real `package update` / `action update` commands followed by the namespace `default` setup error.

Proposed fix

Setup discovery

List actions in the current authenticated namespace and filter fully qualified names for the `setup` package, instead of calling `ops action list setup`. For example:

```sh
setup_prefix="/${OPSDEV_USERNAME}/setup/"
ops action list |
awk -v prefix="$setup_prefix" 'NR > 1 && index($1, prefix) == 1 { print $1 }'
```

Capture the list first so a genuine `ops action list` failure is propagated. An empty result should be a successful no-op.

Dry-run behavior

• Do not execute the `setup` task when `{{.__dry_run}}` is true.
• In `ide/deploy/deploy.js`, make the execution boundary aware of whether a command is mutating.
• When `dryRun` is true, print but do not spawn:
  • `ops package update`
  • `ops action update`
  • `ops -wsk project deploy`
• Local scanning/packaging may continue if desired, but no remote operation should run.

Tests

Add coverage that verifies:

• a missing setup package is a silent success;
• setup actions are selected only from the authenticated namespace;
• a listing failure is not masked by a pipeline;
• `--dry-run` spawns no remote mutation and skips setup invocation;
• normal deploy behavior remains unchanged.

Environment

• OPS CLI: `0.9.1-2607121109.dev`
• Tested task branches: `nuvolaris/bestia:bestia` and `apache/openserverless-task:0.9.1`
• OS/architecture: Linux amd64