deploy.sh: resolve vault key via .keep-vault marker, never fail on keep

Was previously hardcoded to vault key "<project-dir-name>/<env>" with
no marker-file lookup at all -- a real gap versus the design already
written out in PROPOSAL-announce-and-agent.md §4, which this script
never actually caught up to. Repo names, deploy directory names, and
vault keys are three independent strings in practice (a repo can be
named one thing, its deploy directory another, entirely by history/
accident) -- exactly the situation the npm-statuspage rollout hit.

Resolution order: $dir/.keep-vault if present, else fall back to
"<project>/<env>". `keep pull` is now fully best-effort -- missing
vault, missing grant, or keep not installed at all is never fatal,
matches the proposal's explicit requirement that a keep failure means
"doesn't apply to this project (yet)," never "stop the deploy."
Existing/hand-copied .env is left alone if the pull doesn't happen.

Verified with stub keep/docker commands on PATH (no real server
needed for this): a marker-file project with a deliberately mismatched
vault key resolves and pulls correctly; a project with neither a
marker nor a matching vault falls through cleanly to docker compose up
-d without ever touching .env or failing the deploy.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/deploy.sh

@@ -1,14 +1,29 @@
 #!/usr/bin/env bash
-# Pulls a project's env from keep, then brings its docker compose stack up.
+# Pulls a project's env from keep (if it's bootstrapped onto keep), then
+# brings its docker compose stack up.
 #
 # Usage:
 #   ./deploy.sh <project> [env]
 #
-# Expects, per project, a directory at $DEPLOY_ROOT/<project>/ containing
-# a docker-compose.yml. Vault key pulled is "<project>/<env>" (env
-# defaults to "production"). Requires a keep identity already registered
-# and granted read access to that vault on this machine
-# (see INTEGRATION.md).
+# Expects a directory at $DEPLOY_ROOT/<project>/ containing a
+# docker-compose.yml.
+#
+# The vault key is NOT assumed to match the deploy-directory name — repo
+# names, deploy directory names, and vault keys are three independent
+# strings in practice (a repo can be named one thing, its deploy
+# directory another, entirely by history/accident). Resolution:
+#   1. $dir/.keep-vault, if present — a one-time-per-project marker
+#      (`echo "<vault key>" > "$dir/.keep-vault"` when bootstrapping),
+#      one line, human-readable, cat-able to check what's configured.
+#   2. Otherwise falls back to "<project>/<env>" — works when the vault
+#      key genuinely does match, and is also the graceful "not
+#      bootstrapped yet" case for a keep pull that's expected to fail.
+#
+# `keep pull` is always best-effort: a missing vault, a missing grant, or
+# `keep` not being installed at all is never fatal here — it means "keep
+# doesn't apply to this project (yet)," never "stop the deploy." Whatever
+# .env already exists on disk (hand-copied, or from a previous keep pull)
+# is what docker compose reads either way.
 set -euo pipefail
 
 project="${1:?usage: deploy.sh <project> [env]}"
@@ -21,5 +36,18 @@ if [ ! -d "$dir" ]; then
   exit 1
 fi
 
-keep pull "$project/$env" --out "$dir/.env"
+if [ -f "$dir/.keep-vault" ]; then
+  vault="$(cat "$dir/.keep-vault")"
+else
+  vault="$project/$env"
+fi
+
+if command -v keep >/dev/null 2>&1 && keep pull "$vault" --out "$dir/.env.new" 2>/dev/null; then
+  mv "$dir/.env.new" "$dir/.env"
+  echo "  ✓ pulled $vault"
+else
+  rm -f "$dir/.env.new"
+  echo "  · keep pull skipped or failed for $vault (using existing .env, if any)"
+fi
+
 (cd "$dir" && docker compose up -d)