Function build_deploy_zip 

pub fn build_deploy_zip(
    project_title: &str,
    with_script_exec: bool,
    secret: Option<&str>,
    with_testing: bool,
) -> Result<Vec<u8>, CoreError>

Pack the deploy zip: the embedded always-on bundle VERBATIM (the project title substituted into project.json’s title ONLY when project_title differs from DEFAULT_PROJECT — the manifest already says ign-cli), plus — when with_script_exec — scriptExec’s three members with the secret SUBSTITUTED into the template’s __IGN_CLI_SECRET__ marker (exactly-once replace; the 05-01 contract test pins the marker count).

FAIL CLOSED: with_script_exec + None secret is an internal bug guard (the deploy action generates the secret BEFORE packing; shipping the unsubstituted template would arm the gate with the publicly-known placeholder). Some WITHOUT with_script_exec is tolerated and ignored — a stored profile secret never forces a scriptExec deploy.

with_testing appends the embedded TESTING bundle (bundle::testing::TESTING_FILES) after the always-on routes — the Jython framework + testing/run/testing/tags WebDev routes, with every __IGN_CLI_PROJECT__ marker substituted for project_title (the scriptExec marker pattern, count-pinned).

Members ride fixed SimpleFileOptions + deflate (the 05-02 deterministic-zip convention) so identical inputs pack identically.