refactor(app)!: remove App Deployment

[Yevanchen]

Summary

• Remove the App Deployment console, preview, GraphQL surface, commands, provisioners, configuration, identifiers, provider-only dependencies, docs, and translations.
• Remove deployment-bound Agent capabilities end to end, including routes, signed callers, authority, admission, revocation, idempotency scope, and Run provenance.
• Restore ordinary App Overview and PAT-authenticated Public Thread paths to their pre-feature boundaries, while preserving creator-opaque historical Thread reads.
• Keep a migration-only schema entry for append-only historical D1 tables and columns; runtime schema and product code cannot execute them.
• Return retired deep links through the generic 404 route, without a deployment-specific stub, alias, redirect, or feature flag.

Why

• App Deployment was implemented before the product needed it. This is a counterfactual removal of the concept and the architecture built around it.
• Closes refactor(deployment)!: remove App Deployment and bound capabilities #580.

Verification

• Commands:
  • bun install --frozen-lockfile
  • just commit-check
  • just graphql-codegen-check
  • just public-api-openapi-check
  • bun test pkgs/db/tests/migration-schema-boundary.test.ts
  • bun test apps/api/tests/personal-access-token.test.ts apps/api/tests/public-thread-api.e2e.test.ts apps/api/tests/app-overview.test.ts apps/api/tests/api-web-boundary.test.ts apps/api/tests/public-thread-metadata.test.ts
  • bun run build
  • just knip, normalized against a clean origin/main worktree
• Manual steps:
  • Fresh isolated local D1: 12 of 12 migrations applied, then No migrations to apply.
  • Active-source residual scan: zero App Deployment or bound-capability references outside the isolated migration schema and immutable migration history.
  • Production cleanup: 13 of 13 deployments soft-deleted; active runs and command backlog zero; tracked Pages projects, Worker scripts, domains, routes, deployment sandboxes, and deployment Vault secrets zero; known public hosts remain NXDOMAIN after TTL.
  • Immutable migration tree matches origin/main at 6b997438ed233a77910f651e1c05caad01ac16e7.
• Not run:
  • just check reaches the untouched apps/driver tests, then reproduces the same host-specific process-watchdog failures as a clean origin/main worktree at the identical submodule SHA: 1222 pass, 61 skip, 11 fail, 1 error. All preceding formatting, docs, lint, and typecheck stages pass. Current branch adds zero Knip findings versus origin/main.

Impact

• User/API/contract changes: breaking removal of all App Deployment and deployment-bound capability surfaces. Ordinary App, Agent, Session, Run, file, and PAT Public Thread behavior remains.
• Generated files / GraphQL / DB / lockfile: GraphQL outputs updated; no migration file, snapshot, or journal changed; no new D1 migration; lockfile removes deployment-only jsonc-parser and smol-toml roots.
• Env or config changes: deployment-only Worker bindings are removed from source configuration. The three remaining production bindings will be deleted explicitly after the merged Worker is deployed and verified.
• Risk and rollback: D1 history remains readable and production Time Travel bookmarks bracket cleanup. Source can be reverted; deleted external hosting resources would require explicit recreation.

Review

• Closest review areas: API route and GraphQL removal, Public Thread authentication boundary, runtime versus migration-only DB schema, generic Web 404 behavior, and Worker bindings.
• Known trade-offs: historical physical D1 storage remains isolated because applied migrations are append-only; physical deletion requires a separately approved backup and rollback plan.