Port deploy phase transition guards and cleanup markdown projection into agentctl_w4, delete the unused automation module, and pin illegal jumps with a regression test.
Seed fine-grained console permissions (goose 00065), gate admin handlers by system:* keys, and persist settings change audits for all upserts. KB ops and whitelist consumers stay deferred.
Add CAS projection helpers and a real enqueue→claim→command→receipt deploy path for temp-repo tests; PI image compose stays deferred.