[deploy-plugin DPB-16] Plugin CLI children: target add/remove, capabilities, cells apply, eight-op router

[rickylabs]

Part of #892 (RFC #891; corpus .llm/runs/plan-deploy-plugin--seed/ r5).

Children under the deploy mount: target add|remove <key> (peer install + generated descriptor + settings member + assets; remove never edits deploy/targets.ts, --keep-config/--purge-assets); capabilities [<target>] [--json|--preview] (bundled published-manifest preview catalog, honestly labeled); cells apply [<file>] (diff shown); the eight-op router with the locked grammar sketch (global --env; secrets set|list|unset <NAME>; rollback [--to <revision>]; emit [--output <dir>]; down [--yes]). Anti-scope: no top-level command additions (DP-4 §6; KF-5/10/11/12).

Acceptance

• gate: capabilities --json validates against the published schema incl. schemaVersion
• gate: target remove leaves deploy/targets.ts untouched; doctor flags orphans
• gate: cells apply materializes suggested-cells.json with a shown diff

Metadata

Dependencies: DPB-13, DPB-15
Delivery shape: plugin CLI contribution