Render-first deployment command boundary for reviewed manifests.

Dry-run validation is the default. Mutation requires apply => true, an immutable pre-rendered manifest, and the exact destination identity. No shell is involved and command output is bounded and never returned on failures, so credentials cannot be reflected through the CLI result.