Resolve and safely archive local deployment source

[parkedwards]

Creates deterministic SourceBundle archives for local Horizon deployments without importing application code or using AST analysis.
File inputs include an optional discovered dependency path.
Selected config inputs exclude the original file and emit a canonical hosted fastmcp.json with no dependency override.
Horizon #5054 then applies authoritative FastMCP project, additional dependency, and Python resolution.

The hosted config projection keeps only supported build intent and deployment.cwd.
FastMCP fails before upload for environment.editable, deployment.env, and deployment.args.
It also rejects malformed or sensitive dependency URLs and source paths that cross the archive boundary.
The archive applies hard credential exclusions plus .gitignore and .git/info/exclude rules.

The transport boundary is:

file.py[:object] -> source + optional dependency path -> manual Horizon build
fastmcp.json     -> source + hosted config             -> FastMCP Horizon build

[parkedwards]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 781d4ccf6c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jlowin]

Thanks, the latest head fixes the junction and malformed-URL failures. One archive-integrity issue remains for config-based deployments.

environment.requirements and environment.project are written into the archived fastmcp.json, but existing paths are never added to _collect_entries(..., required_paths=...); dependency_files is empty whenever a config is selected. A gitignored requirements file or project can therefore be omitted while create_source_bundle() succeeds, leaving Horizon a config that references a file or directory absent from the archive. I reproduced this with an existing gitignored requirements.txt: bundle creation succeeds and the archive contains the reference but not the file.

Resolve existing configured dependency paths and treat them as required archive inputs, including the required build contents for a project directory. Genuinely missing paths can still be preserved for Horizon to validate remotely.