feat: validate deploy configs without side effects

[alongubkin]

Background

Deploy TOML deliberately uses camelCase outer fields, kebab-case network variant tags, and snake_case provider fields. Users and agents previously had to enter the real deployment path—often after publishing and downloading an installer—just to discover a typo or cross-provider mismatch.

Closes ALIEN-886.

Reproduce

This config uses the wrong provider-field casing:

name = "production"
platform = "aws"
[network]
type = "byo-vpc-aws"
vpcId = "vpc-123"

There was no explicit no-side-effect validation flow. In the public CLI, even the first --validate-only implementation still constructed an execution context first: an inherited ALIEN_MANAGER_URL without ALIEN_API_KEY failed authentication before reading the file.

Fix

Both CLI surfaces support:

alien deploy --config deployment.toml --validate-only
alien-deploy deploy --config deployment.toml --validate-only

The public CLI dispatches validation before manager/platform execution-context construction. The path uses the production serde parser and validates unknown fields, effective platform (including Kubernetes base platform), required non-local name, provider-specific networks, and compute bounds before token resolution, tracker access, or API calls.

Using the executable production parser is the contract here; this PR does not claim to generate a second schema artifact.

Verification

• Subprocess regression sets ALIEN_MANAGER_URL, removes ALIEN_API_KEY, invokes the real alien binary, and proves validation succeeds offline.
• Focused coverage includes wrong-provider networks, Kubernetes base-platform networks, missing names, and --config enforcement.
• CI at a4b23c994: Rust, TypeScript, qualification, conventions, and automated review all pass; Greptile re-review is running.

[alongubkin]

@greptileai review

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; validation now returns before authentication, tracking, or deployment execution, and both previous findings are resolved.

Summary

The PR adds side-effect-free deployment configuration validation to both CLI surfaces.

• Adds --validate-only, requiring an explicit configuration file.
• Routes public alien deploy validation before execution-context and authentication resolution.
• Validates platform, Kubernetes base platform, deployment name, compute pools, and provider-specific network settings.
• Adds regression coverage for inherited manager configuration and previously reported contract mismatches.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Parse CLI arguments] --> B{deploy --validate-only?}
    B -- Yes --> C[Read local TOML config]
    C --> D[Resolve and validate platform]
    D --> E[Validate name, network, compute, and inputs]
    E --> F[Print config is valid]
    B -- No --> G[Resolve execution context and credentials]
    G --> H[Run deployment workflow]

Loading

_{Reviews (3) · Last reviewed commit: "fix(cli): keep deploy config validation ..."}

[alongubkin]

@greptileai review

[alongubkin]

@greptileai please re-review the latest head, focusing on whether public --validate-only is fully offline before execution-context/auth resolution.