feat(deploy): first-run provisioning phase [SD-5]

[rickylabs]

Part of #830 — subordinate slice of #833 (gap G2). Generalizes #456's minimal provisioning into the manifest provisioning[] phase (data dirs, secrets bootstrap, schema init via db verbs, health-gated first start).

Depends on: #831, #833.

• gate: run-twice idempotency; first-run e2e

Design source: PR #822 (rfc.md + plan.md rev 10, 9-cycle adversarial trail) in .llm/runs/rfc-single-deployment--orchestrator/.