feat: add relay deployment contract

[leether]

Purpose

Make source-to-relay script identity an executable pre-push contract so article pushes cannot silently use a stale shared writer.

Root cause

The article bundle upload and the relay shared-script deployment were separate manual operations. Repository upgrades could therefore add writer arguments or evidence behavior without updating the relay runtime.

Changes

• add a default read-only manifest check and explicit Human-gated apply command
• verify per-file hashes, Node syntax, and required writer flags
• stage the full manifest, preserve per-file backups, verify after promotion, and restore the whole manifest on failure
• gate automatic and generated-manual relay push paths on the read-only check
• document deployment in README, SKILL, CHANGELOG, spec, and Gotcha G39

Validation

• npm run check
• full privacy gate
• local success and whole-manifest rollback shell simulations
• configured relay read-only check: manifest and required flags aligned

Live boundary

No relay apply, WeChat draft creation, or CATALOG mutation was performed.