Offer an example project when the user has nothing to deploy

[jeroenrinzema]

Closes #4.

deploy.md gets a Step 0 that offers one of BrainPod's own demos when the user has nothing in hand. The four open questions in the issue, settled:

Where the example comes from — brainpodnl/whiteboard and brainpodnl/astroid, both public and MIT-licensed, both written for exactly this ("Deploy it yourself" in each README pastes a prompt that invokes this skill). No application code is committed here; the agent clones, so the example stays matched to whatever the repos ship. This also drops the generate-an-app option — a generated app has no AGENTS.md, and that file is what makes the rest of Step 0 short.

What the example should be — not a static page. Both deploy the same shape: a Next.js service on PORT with a Route, plus a managed Postgres and Valkey. That is the shape a user's own app will have, and it avoids the port-80 Caddy trap being the first thing a first-timer meets.

How the user gets asked — the trigger requires both that the user named no project and that the working directory holds no source. Anything project-shaped is theirs, and the instruction is to ask, never to clone over it. The consequence is spelled out because it is worse than "recoverable politely": /v1/pods/{pod} is GET-only in src/openapi.json — there is no pod delete anywhere in the API, so a pod created on a wrong guess outlives the session and nothing the agent can run takes it back.

How this composes with #12 — this branch is rebased onto the mandatory browser preflight. Step 0 runs first because choosing and cloning the example is what makes the project/display name derivable. Immediately afterward the agent returns to SKILL.md, records browser preference and browser control, asks calibration with the real project name, and clears the console and identity gates before Step 1. No login, pod creation, deployment mutation, or image build can bypass #12's checkpoints.

Where it goes — extended deploy.md rather than adding a reference. This is a branch off its front end, and every step from 1 onward is the same path; a separate file would have duplicated pod creation, the draft/diff discipline, and the deploy-and-verify steps. Nothing moved up into SKILL.md either — having nothing to deploy is specific to this workflow, not shared with operate or debug.

Budget

deploy.md goes 317 → 351 lines, and it was already the standing exception. What the 34 lines buy:

• The trigger and its consequence (7) — the one part that cannot be got wrong safely, given no pod delete exists.
• The offer and the two repos (8) — the user picks; one line each on what they'd actually see.
• Clone into a subdirectory, then preflight and calibrate (5) — a declined offer and a misread directory both leave the tree untouched, while fix: enforce browser deployment gates #12's gates resume as soon as the project exists.
• Read the clone's AGENTS.md in place of Step 2 (7) — both repos state the port, readiness path, resource graph, trial-sized instances, and how each database's connection details reach the App. This prevents re-deriving those facts or overwriting their existing Dockerfile and .dockerignore.
• Ordering note in the intro, heading, blanks (7).

Routing stayed at two places: the one SKILL.md entry for deploy.md was extended in place, and the reference's frontmatter description picked up one clause — no new bullet, no new file, no extra prominence.

Verification

• Rebased onto main containing fix: enforce browser deployment gates #12; the PR remains one commit and mergeable.
• No pod delete: src/openapi.json in brainpodnl/cli lists /v1/pods/{pod} as get only. resources/{kind}/{namespace}/{name} is the only path with delete.
• Both repos: public, MIT, Dockerfile + .dockerignore at the root, USER 1000, PORT defaulting to 3000, and AGENTS.md present.
• git diff --check passes; all three plugin manifests parse and match.
• Nothing here restates a flag, resource field, or default that describe provides.

Manifests bump 1.17.1 → 1.18.0 in lockstep — new capability, non-breaking.

metadata.required_access is unchanged. Step 0 is a git clone of a public repo, which is not gh, and the result is source the agent then reads under the existing CODEBASE.