[deploy-plugin DPB-19] deploy-events stream, telemetry, runtime-config topic

[rickylabs]

Part of #892 (RFC #891; corpus .llm/runs/plan-deploy-plugin--seed/ r5).

Versioned deploy-events envelope (started/succeeded/failed/rolled-back; target+variant, environment, artifact digest, actor, trace context); telemetry span vocabulary with secret redaction at the seam; a tiny deploy runtime-config topic (checked at each CLI/CI invocation). Anti-scope: core deploy success never depends on the stream sink.

Acceptance

• gate: sink outage cannot fail a deploy (fault test)
• gate: sentinel secret absent from events and spans

Metadata

Dependencies: DPB-15
Delivery shape: plugin contributions