cli: close hosting-target abstraction leaks behind the HostingProvider seam (#506)

Target-specific behavior had leaked out of the hosting backends into shared CLI code, so adding a new hosting target meant touching switches scattered across the tree. Deployment-layer push routing no longer switches on target: each HostingProvider supplies a deploymentLayerTransport (fly's ssh-console transport, the signed-HTTP transport with secrets-manager fallback, docker's local-port transport) in its own backend file. Per-target env-default tables move into target-env-defaults.ts exposed as HostingProvider.envDefaults, service context URLs become provider-supplied fields, infra becomes an optional per-provider capability map instead of a hard gate, and sandbox-backend rules come from a policy table keyed by target. A secret-schema conformance test enumerates the gaps, so a new target is one registry entry plus one backend file and the compiler finds everything else.

**Deployment notes**

Pure CLI refactor moving target-specific transport/env-default/sandbox-policy logic behind the
HostingProvider seam; commit states no behavior change intended for fly/aws/docker and adds a
secret-schema conformance test — residual risk is regression-only, no DB/config/contract
surface

Stacked on #468 — merge that first.

<!-- codesmith:footer -->
---
<a href="https://app.blacksmith.sh/yc-software/codesmith/qm/pr/480"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-light-v2.svg"><img alt="View with [code]smith" src="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"></picture></a> <a href="https://backend.blacksmith.sh/track/enable-autofix?expires=1789249120&installation_model_id=19911&pr_number=480&repository=yc-software%2Fqm&return_to=https%3A%2F%2Fgithub.com%2Fyc-software%2Fqm%2Fpull%2F480&signature=aa886550348b04d0e235ecf22c6a9676913d82f7b8c12bac59a274291626b795"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg"><img alt="Autofix with [code]smith" src="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"></picture></a>
<sup>Need help on this PR? Tag <code>@codesmith-bot</code> with what you need. Autofix is disabled.</sup>

<!-- codesmith:autofix:disabled -->
<!-- /codesmith:footer -->