fix(cli): require folder upload opt-in and isolate archive staging

[AbdullahM07]

Summary

Require an explicit folder upload choice and stage its archive outside the source tree. Clean up the staging directory even when tar fails before upload.

Motivation

Running openship deploy --project ... --service-ids ... from a non-Git scratch directory silently uploaded that directory. When it contained TMPDIR, the archive could include earlier uploads and its own output. Packaging happened before the cleanup block, leaving failed archives behind to grow on subsequent attempts.

Related issue

Fixes #853

Changes

• Add --folder for explicit upload, including from a Git checkout; preserve --name as an upload opt-in outside Git.
• Refuse implicit uploads outside Git. An explicit --branch selects the existing Git deployment endpoint; reject Git-only options combined with --folder.
• Resolve symlinks before rejecting the temporary directory or an ancestor as the source, before provisioning an upload session.
• Use a private per-run staging directory and cover packaging and upload with the same finally cleanup.
• Update CLI documentation and add real-tar regressions plus command-level coverage for both deployment paths.

Verification

• Before the fix: four archive regressions fail, including a partial tarball surviving a packaging error.
• bun run --cwd apps/cli test --maxWorkers=2 --testTimeout=15000: 40 files, 506 tests passed. The final two explicit-upload cases also pass in bun run --cwd apps/cli test deploy-folder-opt-in --maxWorkers=2 (6 tests).
• bun run --cwd apps/cli lint: passed.
• Root non-CLI workspace tests: all six tasks passed.
• Ran bun run format in an isolated checkout and retained only scoped formatting.

The CLI suite uses a 15-second timeout because its existing port-release test waits six seconds when local port 3001 is occupied; the running local server was left in place.

Checklist

• One issue per PR, with a scoped diff
• Regression tests fail before the fix and pass afterward
• Relevant tests, typecheck and formatting completed locally
• Reviewed the implementation and test behavior