carlos / platform Public

deploy-credential: a rung-scoped deploy credential so CI promotes through the console (#229)

A `deploy` service role with a rung scope (canary, edge, beta; never
stable). CI ships, promotes and rolls back through the console with no
more authority than a scoped release key, and can run `carlos deploy`
(R6). Each deploy promote is signed by a request-local scoped grant, so
boxes still verify the rung limit. The scope check runs in the handlers
and, authoritatively, inside the release primitives between the pointer
read and the conditional write (G1/G2; the in-flight gap accepted, R5).
The CLI reads CARLOS_SERVICE_TOKEN with CARLOS_CONSOLE. README and CLI
docs point CI at the console; direct-bucket mode is the operator's path.

Spec docs/superpowers/specs/2026-10-05-deploy-credential-design.md
(rev 5.2, five Astra rounds); plan docs/superpowers/plans/
2026-10-05-deploy-credential.md. Every task reviewed; Astra whole-branch
review fixed and re-reviewed; full gate and CI green on 91026571.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Squashed from design-deploy-credential into main.