Function webdev_deploy 

pub async fn webdev_deploy(
    api: &dyn GatewayApi,
    project: &str,
    with_script_exec: bool,
    rotate_secret: bool,
    config_path: &Path,
    profile_name: &str,
) -> Result<WebdevDeployResult, CoreError>

ign webdev deploy — pack the embedded bundle, import it overwrite-style, own the secret lifecycle.

Secret rules (the plan’s LOCKED posture): a fresh secret is generated + persisted 0600 when (a) --with-script-exec finds no stored secret, or (b) --rotate-secret asks regardless; a plain scriptExec deploy reuses the stored secret unchanged. Persisting happens BEFORE the upload: a failed import then leaves a stored secret the NEXT deploy packs as-is (self-healing), and a broken config store refuses before any gateway I/O.