[deploy-plugin DPB-17] Scaffolder: deploy/ leaf, Story-0 assets, conditional capability-check pipeline step

[rickylabs]

Part of #892 (RFC #891; corpus .llm/runs/plan-deploy-plugin--seed/ r5).

Userland deploy/targets.ts leaf + per-target assets on target add (golden test per emitter). The conditional netscript-capability-check Aspire pipeline step (registered only when the deploy plugin is present AND ≥1 Aspire target descriptor resolves; snapshot-verified via the single compiler entrypoint; standardized failure with the recovery command + diagnostics path). Anti-scope: no init --deploy sugar (deferred fork) (DP-4 §4; SG-3/SG-4, KF-2).

Acceptance

• gate: no plugin ⇒ generated AppHost has no step import; aspire start/deploy valid
• gate: step verdict parity with CLI plan over one snapshot
• gate: goldens for every emitted artifact

Metadata

Dependencies: DPB-5, DPB-8, DPB-15
Delivery shape: plugin scaffold contribution