feat: resolve flow KB/MB dependencies into the deploy artifact (#14728)

* feat(deploy): resolve flow KB/MB dependencies into the deploy artifact

Scan flow templates for Knowledge Base / Memory Base references and
resolve them from the owner's rows into the project artifact manifest,
so a deployed flow carries the KB/MB specs the serving plane must
provision. schema_version stays 1 (byte-identical) when a flow has no
dependencies, preserving backward compatibility; it rises to 2 only
when dependencies are present.

backend_config is scrubbed of raw secret-shaped values before it is
emitted -- only routing keys and *_variable name pointers survive
(defense in depth: the serving plane resolves credentials by variable
name and never reads secret values from backend_config).

Adds targeted unit tests for _collect_dependency_refs, _resolve_dependencies
(shape + backing-KB dedup) and the _scrub_backend_config secret strip.

* fix(deploy): validate dependency provisioning metadata

---------

Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local>
Co-authored-by: Eric Hare <ericrhare@gmail.com>