perf(deploy): ticket #430 deploy speed — isolated from the CLI split, with review fixes

[elliotBraem]

Ticket #430 (deploy speed), isolated from #437 per review — the perf commits rode the CLI-split branch unreviewed, and the first perf pass had corrupted installBundleFetchFromEnv (this branch carries the repair).

Stacked on #437 (base feat/cli-split); retarget to main once #437 merges.

What lands

• Content-hash rebuild oracle (contentHashStalenessOracle): sha256 over the member tree + transitive local-dependency hashes + build-mode env, persisted at .bos/build-cache.json; unknown/missing dist/hash mismatch errs toward building; --force-build / BOS_FORCE_BUILD=1 retains the blanket force.
• Build cap: deploy parallel group runs through mapWithConcurrency capped at min(concurrency, os.cpus()).
• Parallel pipelined uploads: uploads start as each build completes (onWorkspaceBuilt), bounded by a semaphore (BOS_UPLOAD_CONCURRENCY, default 4); entries assemble in target order — the published config is byte-identical to the serial train's.
• Tx-tracked confirm: cheap history probes with a 2-probe trial window, then one authoritative read-back; falls back to plain equality polling.

Review fixes on top (this branch's own commits)

1. Slot-transfer semaphore — the first pass's hand-rolled semaphore lost one count per waiter wake and over-admitted past BOS_UPLOAD_CONCURRENCY under late build completions; extracted createSemaphore (release hands the slot to a waiter, count conserved) with deterministic unit tests (upload-semaphore.test.ts: transfer semantics + 200-work churn never exceeds the limit).
2. No masked upload failures — a pipelined upload dying while the build also fails now names the parallel upload error in the build-failure PublishTrainError instead of discarding it.
3. Build-mode oracle key — the hash's env term now comes from the mode the train will actually build with ({ nodeEnv, deploy } from build-train), not process.env (which never carries DEPLOY on a normal deploy — the term was decorative and let a dev-built dist judge as deploy-fresh); pinned by a mode-change test in build-staleness.test.ts.
4. Probe fallback matches the comment — a failed history probe now consumes a skip credit, so repeated failures fall back to equality polling as documented (was: retried the doomed probe every iteration).
5. installBundleFetchFromEnv signature repaired — the first perf commit dropped the parameter-list close and the normalizeBundleDir lines; typecheck could not run at the old tip.

Test plan

• pnpm run typecheck / lint / test at this tip (the perf commits were never verified post-review-fix before; the old tip did not compile)
• deploy-train-service.test.ts upload-order/ordering/serialization cases unchanged

[railway-app]

🚅 Deployed to the everything-dev-pr-441 environment in heartfelt-ambition

9 services not affected by this PR

• api-db-6AR0
• dev-app
• projects
• projects-db
• auth-db-ISTt
• upload.everything.dev
• app
• api-db
• auth-db