feat(workers): preserve native deployments and exact plans

[dxiongya]

Wrangler imports and project deployment commands could lose framework build intent, misclassify generated metadata, and expose low-level Artifact primitives without a clear normal workflow. The deployment preview also depended on whatever output happened to exist locally, while push could create a Worker or managed resources before discovering that the application build was invalid.

This PR preserves native Wrangler packaging, keeps public vars separate from Secrets, and defines the normal flow as init → plan → push → inspect → promote:

• workers plan runs the configured local build with credential-shaped environment variables removed, validates the exact native Artifact and assets, then compares the desired project with live xAPI state without remote writes.
• The plan shows changes, existing reused state, exact Artifact hash/size, budget-cap delta, active price-book visibility, and usage-dependent resource cost effects. Unknown traffic or storage remains unknown.
• workers push uses the same preparation path before any Worker, budget, resource, Artifact, or Deployment mutation, presents the final plan, applies it, health-checks the public URL, and returns a read-only inspection.
• workers inspect aggregates Worker, environment, active Deployment and Artifact, routing, resources, Secret metadata, environment-scoped domains, and billing freshness. Optional read failures remain UNKNOWN; Secret values are excluded.
• Build progress is forwarded to stderr so --format json remains machine-readable.
• Help and bundled Skills separate project deployment from advanced build/upload/deploy primitives.

This complements xapi-backend #248/#250 and does not reimplement backend Artifact, static asset, Smart Placement, resource-location, or completeness-validation behavior. First-class plain_text bindings and Worker-to-AI correlation tracing remain recorded as backend follow-up work.

Validation:

• bun install --frozen-lockfile
• bun run typecheck
• bun run build
• bun run test — 527 passed, 0 failed
• npm pack --dry-run --ignore-scripts — 82 files
• git diff --check
• sanitized Wrangler import replay for the two real projects
• live production-control-plane Jev preview plan: no changes, exact Artifact matched, $0.50/day budget unchanged, price book cf65a-production-all-resources-20260918-v1 with 23 rates, valid JSON stdout