feat(cli): deploy config banner, eager secrets validation, health-wait beacons

[mhenrixon]

Summary

Implements issue #10 (R1 DX): make deploys explain themselves before, during, and while waiting.

• Config banner — deploy/redeploy/setup open with the effective topology: service, destination, version, each role with host counts, proxy hosts, timeouts, and on dash the loadbalancer state — including loadbalancer: 1.1.1.1 (auto-enabled: primary role web has 2 hosts), the line that would have made the 2026-07-03 auto-LB surprise visible.
• Eager secrets validation — new Kamal::Configuration#validate_secrets! resolves every secret the deploy needs (registry credentials, role env secrets, builder secrets, custom SSL PEMs; accessory secrets on setup) right after the banner. A missing secret now fails in seconds with the usual ConfigurationError, instead of minutes later after the image build. Secret adapters (1Password etc.) run at deploy start instead of mid-deploy — same work, earlier.
• Health-wait progress beacons — the healthcheck Poller prints Container not ready yet, retrying in 2s (3s elapsed, 27s left) on each retry instead of sleeping silently; the proxy deploy path announces its bounded wait (Deploying web on 1.1.1.1 via kamal-proxy (waiting up to 30s for it to become healthy)...) before the blocking kamal-proxy deploy.

Branch structure: issue-10-boot-banner-eager-validation-beacons (rooted off main, upstream-compatible, all three features) merged into this integration branch, plus one dash-only commit adding the loadbalancer banner line.

Closes #10

Test plan

• bundle exec ruby -Itest test/cli/main_test.rb — banner content/order, fail-fast on missing secrets
• bundle exec ruby -Itest test/cli/healthcheck/poller_test.rb — beacons
• Unit suite green (only the pre-existing Apple-Silicon/docker builder failures, identical on clean main)
• bin/test in CI (deploy-path change)

Deviations & judgment calls

• Upstream test deploy with missing secrets asserted deploy proceeds when secrets are unresolvable — the exact behavior this issue inverts. Rewrote that test to assert fail-fast (ConfigurationError before any invoke) rather than keeping a contradictory test plus a new duplicate; reused upstream's deploy_with_secrets.yml fixture.
• The "loadbalancer auto-enabled" banner line requires dash-only code, so it lives in a single dash-side commit on this integration branch; the main-rooted feature branch stays upstream-PR-able.
• Beacons are implemented in the Poller, where the local retry loop lives. The proxy path's wait happens inside remote kamal-proxy deploy; a true local ticker would need a background thread around a blocking SSHKit execute — descoped to a one-line bounded-wait notice. Full ticker is R2 territory if still wanted.
• validate_secrets! includes accessory secrets only for setup (boot_accessories: true); deploy/redeploy never touch accessories.
• Discovery, filed as Loadbalancer auto-activates for a proxy-less primary role #33: the banner exposed that auto-LB activates for a proxy: false primary role (nothing to balance). Not fixed here — behavior change beyond this issue's scope. Because of it, the negative banner test uses a new deploy_with_loadbalancer_false.yml fixture (explicit opt-out) instead of the workers-only fixture.
• cli_test_case.rb globally stubs load_balancing? false for upstream-inherited tests; the banner tests unstub it locally to exercise the real predicate.