feat(deploy): 1.11.0 — /lua-deploy webapp deploys just the web app (lua-cli 3.49.0+)

[selcuk-lua]

What

lua-cli 3.49.0 (now npm latest; lua-core-services #5293) adds lua deploy webapp. It is a scoped promote, like lua deploy webhook: a new agent version identical to the live one except that web app's pin is created and promoted. Nothing else staged on the agent goes live. A failed deploy changes nothing, and a disabled app is never switched on.

Until now the plugin made a web app live by creating a whole agent version, diffing it against the live one, and stopping when anything other than web apps would change. That path stays for CLIs below 3.49.0.

File	Change
commands/lua-deploy.md, agents/lua-deploy-pilot.md	⏳ 3.49.0+: push, then LUA_DEPLOY_CONFIRMED=1 lua deploy webapp --ci --name <n> --set-version <v> --force. Below: the agent-version path with diff-and-stop, unchanged. The pilot reads lua --version before step 5. 503 SCOPED_PROMOTE_FAILED and 409 SCOPED_PROMOTE_CAP_EXHAUSTED are reported as failed deploys. The switched-off warning is quoted. The rollback line is lua deploy webapp --set-version <previous>, which rolls back that app only.
commands/lua-new.md, commands/lua-push.md, agents/lua-skill-builder.md, lib/knowledge/decision-trees.md, SECURITY.md	The next step is /lua-deploy webapp, not /lua-deploy agent-version.
lib/knowledge/web-apps.md	§1 and §7: the 3.49.0+ deploy, rollback and switched-off rows, with the agent-version rows kept for older CLIs. §3: the Data.get example passes the filter as the second argument (it showed { filter: … }), plus a note on the .default() typing in lua-cli 3.49.0 and earlier (lua-core-services #5535 fixes it in the next release).
scripts/lint-knowledge-commands.mjs	deploy gains webapp; push gains decision. Main's decisions docs use lua push decision, and the check only runs where LUA_CLI_SRC is reachable, so main's CI skipped it.
Version	1.11.0 (rebased on main, where /lua-decisions #22 took 1.10.0) in package.json, plugin.json, marketplace.json, the MCP package, its version strings and the rebuilt dist/server.js; CHANGELOG entry above 1.10.0.

Safety model unchanged. It is still one AskUserQuestion in /lua-deploy, with every production verb carrying the LUA_DEPLOY_CONFIRMED=1 prefix. The confirm-deploy hook is type-agnostic, so it needs no change. No --auto-deploy is added anywhere.

Versioning: #18 (fix/deploy-hook-false-positives) is still open and declares 1.7.1. If this PR merges first, #18 takes 1.11.1.

Checks

• npm run lint with LUA_CLI_SRC pointing at lua-cli main: clean.
• npm test: 68 suites, 2072 tests passed.

🤖 Generated with Claude Code

[richard-lua]

Code review — LOW risk

This is a documentation and version-bump PR adding the lua-cli 3.49.0 lua deploy webapp scoped-promote path to the plugin's prompts, knowledge base, and lint allowlist, plus synchronized 1.10.0→1.11.0 version strings across every manifest, the MCP package, and the rebuilt bundle. The safety model is untouched: every production verb still carries the LUA_DEPLOY_CONFIRMED=1 prefix, the type-agnostic confirm-deploy hook needs no change, and no --auto-deploy is introduced. The guidance is internally consistent (deploy/push/new/skill-builder/decision-tree/SECURITY.md/web-apps.md all updated together) and correctly gates the new path behind a lua --version check with the agent-version fallback preserved for older CLIs.

Minor

• scripts/lint-knowledge-commands.mjs:105 — webapp added to the deploy allowlist with a 3.49.0 comment. Since the lint only runs where LUA_CLI_SRC is reachable and uses a hand-curated set, confirm CI pins a lua-cli revision at/after 3.49.0 so the docs reference a command the CLI actually exposes.
• mcp/lua-platform/dist/server.js — the rebuilt bundle ships as a non-reviewable diff; confirm it was produced by npm run build and contains only the version-string changes reviewed in server.mjs/api-client.mjs.

---

_{PR Risk Reviewer — automated senior review of eaeb23c · risk: low · confidence: 0.84}