Add the deploy finish API and umbrella CLI

makeCtx serves finish over the CAS and ActionQueue; cli.ts adds the
build/deploy/run/inspect verbs (unwired until cutover). Copy-mode
materialization chmods CAS-sourced files back to 0644.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tools/build/artifact.ts

@@ -70,6 +70,7 @@ export interface RuleDecl {
     outputs : Artifact[];
     cmds : string[];                // flattened PRE-substitution templates
     display : string | null;        // nominally substituted; cosmetic
+    displayTemplate : string | null;  // pre-substitution; groups forEach rules
     nameSensitive : boolean;
 }
 
@@ -155,6 +156,7 @@ function makeDecl(inputs : Input[], deps : Input[], spec : CmdSpec, outputs : st
         outputs: [],
         cmds,
         display: null,
+        displayTemplate: spec.display ?? null,
         nameSensitive: spec.nameSensitive ?? false,
     };
     if (decl.nameSensitive) {

tools/deploy/package.json

@@ -9,7 +9,7 @@
         "tar-stream": "^3.0.0"
     },
     "scripts": {
-        "test": "node --test test/script.test.ts"
+        "test": "node --test test/*.test.ts"
     },
     "type": "module"
 }

tools/deploy/script.ts

@@ -145,6 +145,9 @@ export class ActionQueue {
                         fs.linkSync(op.src, dst);
                     } else {
                         fs.copyFileSync(op.src, dst);
+                        // The copy inherits the source mode; CAS objects are
+                        // read-only, which must not leak into deploy trees.
+                        fs.chmodSync(dst, 0o644);
                     }
                 } else if (op.type === 'Write') {
                     fs.writeFileSync(dst, op.data);

tools/deploy/tsconfig.json

@@ -3,5 +3,6 @@
     "exclude": ["test"],
     "references": [
         {"path": "../../data/lib"},
+        {"path": "../build"},
     ]
 }