[deploy-plugin DPB-9] Extract deploy-deno (honest manifest; no emit by design)

[rickylabs]

Part of #892 (RFC #891; corpus .llm/runs/plan-deploy-plugin--seed/ r5).

Wrap the built-in deno deploy CLI (target key deno-deploy). Honest manifest rows: @netscript/kv:atomic per the leaf's atomic conformance; kv:queues and queue:consume unsupported; runtime:cron lossless; sagas externalized. emit is deliberately not declared — the platform builds from source; getting-started flow is plan → up (declared-subset showcase). Transitive unstable-scan improvement noted as follow-up. Anti-scope: no CI-split claims on this target (DP-3 §3, KF-9).

Acceptance

• gate: declared subset excludes emit; calling it yields DeployOperationUnsupportedError
• gate: manifest rows carry evidence ids from the suite
• gate: plan → up flow green against a live app (probe lane)

Metadata

Dependencies: DPB-3, DPB-5
Delivery shape: adapter extraction wrapping deno deploy