Hash-verified config deployment (FLT-51)

deploy-config copies tracked files from a Git worktree to every fleet PC without decoding or re-encoding their content. It preflights all destinations before writing any target, transfers through scp, verifies the staged SHA-256, atomically promotes it, then reads the final bytes back and prints their observed SHA-256. A second run reports Unchanged and does no writes.

Promotion uses a no-overwrite rename protocol: an existing destination is first renamed to a private backup and hashed there, and the staged file is renamed into the now-empty name only when that captured hash is recognized. A concurrent writer wins the destination name; deployment then fails without overwriting it and retains/restores the prior bytes. If the SSH process is killed during the brief captured-backup window, the next read restores a backup only when its same-transaction staged file still exists (proof promotion did not commit). A backup stranded after commit is never resurrected. Multiple recoverable transactions are treated as ambiguous and require manual recovery; they are never guessed away.

fleet-dispatch deploy-config `
  --repo C:\path\to\canonical-repo `
  --manifest deploy\fleet-config.json `
  --targets all

Manifest paths are relative to --repo; the manifest and every source must be tracked by Git. Destinations are relative to each remote user's profile.

{
  "files": [
    {
      "source": "skills/council-code-review/SKILL.md",
      "destination": ".claude/skills/council-code-review/SKILL.md",
      "variants": {
        "ANDYGREATROOMPC": "variants/codex/council-code-review/SKILL.md"
      },
      "recognizedOldHashes": [
        "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
      ]
    },
    {
      "source": "config/CLAUDE.md",
      "destination": ".claude/CLAUDE.md"
    }
  ]
}

Variants are explicit canonical files, not exceptions applied to live copies. This prevents the Codex harness's intentionally inverted review gate from being overwritten by the Claude variant.

Drift rule

An existing destination may be replaced only when its hash equals the desired hash, appears in the local successful-deployment ledger, or is listed in recognizedOldHashes. Any other hash is unrecognized drift: the command exits nonzero before staging anything anywhere. Inspect and commit valuable live changes into the canonical repo; never treat the live file as canonical.

The default ledger is %USERPROFILE%\.claude\fleet-deploy-state.json; override it with --state. For first adoption of known old fleet copies, review their hashes and put those exact values in the tracked manifest. Do not use a force flag—none exists.

SSH host lookup uses the fleet peer registry. Remote content operations are byte APIs plus scp; Set-Content, Out-File, and text encoding conversions are not used.