docs: ship Blog 09 + fix Social 4 verb count and resolve-chain claim

[bpamiri]

Summary

Three coordinated changes for today's wheels deploy launch (Social 4 + Blog 09):

1. Ship Blog 09 — web/content/blog/posts/wheels-deploy-kamal-port.md

Launch-day blog post, authored via the blog admin tool and exported atomically by PostExporter. Body matches the skeleton at docs/releases/blog-skeletons/09-wheels-deploy.md verbatim — 135 body lines, 24 em-dashes preserved as proper UTF-8.

CI auto-publishes: merging this PR triggers web-deploy.yml (paths watcher on web/**), which builds site-blog via Astro and deploys to Cloudflare Pages. No manual pnpm build step needed.

Note on the export: the EasyMDE-paste path corrupted UTF-8 em-dashes to MacRoman mojibake (— → —) on the initial save; the body was repaired by rewriting the DB column with the source skeleton bytes and re-firing the export through /jobs/runScheduledPublish. Title and summary were unaffected (different paste path). A follow-up bug for the EasyMDE charset issue is worth filing for the next blog post.

2. Slack — "~25 verbs" → "50+ commands across 9 sub-command groups"

The Slack post under-counted the actual subcommand surface by ~2x. Counted on develop:

Group	Leaf paths
Top-level (init, setup, rollback, config, version, details, audit, remove, docs)	9
app (boot/start/stop/details/containers/images/logs/live/maintenance/remove)	10
proxy (boot/reboot/start/stop/restart/details/logs/remove)	8
accessory (boot/reboot/start/stop/restart/details/logs/remove)	8
build (deliver/push/pull/create/remove/details/dev)	7
registry (setup/login/logout/remove)	4
server (exec/bootstrap)	2
prune (all/images/containers)	3
lock (acquire/release/status)	3
secrets (fetch/extract/print)	3
Total	57

Replaced with (50+ commands across 9 sub-command groups). Also reworded the trailing list to make it clear that rollback/audit/details are top-level verbs, not sub-command groups.

3. GitHub Discussions — drop the "CLI overrides" claim from the resolve chain

Original Discussions copy:

${VAR} references resolve through the same lookup chain Kamal uses (CLI overrides → .kamal/secrets → System.getenv → empty string).

Reality: every production Deploy*Cli.cfc instantiates new ConfigLoader() with no args, so envOverride is always empty in production. It exists for test injection only. No CLI flag like --env=KEY=VAL ships. Replaced with the truer 3-step user-observable chain: (.kamal/secrets → process environment variables → empty string).

4. Cleanup — fix the stale ConfigLoader.cfc line-7 comment

Line 7 listed (envOverride → System.getenv → ""), omitting .kamal/secrets. Eight lines below, the correct 4-step chain is documented. Now both match — closes the doc-drift loop opened by #2430.

Diff stat

 cli/lucli/services/deploy/config/ConfigLoader.cfc   |   2 +-
 docs/releases/blog-skeletons/social-announcements.md |   4 +-
 web/content/blog/posts/wheels-deploy-kamal-port.md  | 157 +++++++++++++++++++

The .cfc change is one line, comment-only — no functional code changes.

Test plan

• Commit-message lint passes (docs: type, no scope, header < 100 chars per commit)
• CI web-deploy.yml job runs on merge — builds site-blog, deploys to Cloudflare Pages
• After deploy, https://blog.wheels.dev/wheels-deploy-kamal-port renders with em-dashes as —, code blocks intact, ${VAR} shown literally
• Spot-read Slack and Discussions blocks of Post 4 in social-announcements.md for fluency before posting