v0.4.0 — capy deploy + zero-trust positioning

Headline

`capy deploy` ships. End-to-end deploy flow with platform connectors for Cloudflare Workers, Cloudflare Pages, and Vercel, plus a plugin test harness so future connectors can be added safely. Run `capy deploy` to walk through connector setup, issue a scoped deploy token, and wire up the platform-side env vars / build hooks needed for the target to pull decrypted secrets at deploy time.

What's new

• `capy deploy` with platform connectors (#180) — Cloudflare Workers, Cloudflare Pages, Vercel, plus the plugin framework for adding more.
• Plugin test suite (#180) — every connector exercised against a mock platform so adding a new one is a self-contained change.
• Zero-trust positioning in the README (#184) — the README now leads with the structural differentiator (the service can't read your secrets) instead of generic "encrypt your .env" framing. Links out to the new comparisons hub and AGPL explainer.

Install

```bash
npm install -g @capysc/cli@0.4.0

or

brew upgrade capysc/tap/capy
```

Upgrade notes

No breaking changes. `capy`, `capy run`, `capy edit`, `capy invite`, `capy kick`, and the rest of the existing surface are unchanged. New surface is additive — `capy deploy` and the connector subcommands.

Docs

• `capy deploy` reference
• Deploy guides per platform
• Comparisons