bos-auth: 04 custody preview environment — Outlayer custody wallet publish via publish.auth: "custody" seam

[elliotBraem]

Sprout of #274 (v2 platform services spec); sibling of #288/#289 in the gasless-auth sprint. Builds on the publish.auth seam from #288.

What to build

A custody preview environment for agents and workshop attendees: a publish identity with zero key exposure, powered by Outlayer agent custody.

1. publish.auth: "custody" credential kind (seam reserved in bos-auth: 01 bos login — session + scoped FC key export, bos.config.json driven #288) becomes real: bos login --custody (or auto-provision on first publish) calls Outlayer POST /register once to mint a custody wallet (API key wk_... + TEE-derived implicit NEAR account). The API key is stored in .bos/ (gitignored).
2. Policy handoff: on registration the CLI opens the Outlayer dashboard handoff URL so the wallet owner whitelists the FastKV registry contract with per-transaction gas/deposit caps (mirrors the relayer whitelist posture). Publishing is blocked until policy is confirmed.
3. Publish path: bos publish under the custody credential routes the FastKV set_values write through Outlayer POST /wallet/v1/call — signed inside the TEE, broadcast by the CLI. Publishes land under the custody wallet's own implicit namespace (bos://<implicit-account>/<gateway>), never a named account/org.
4. Headless NEP-413 auth: use Outlayer POST /wallet/v1/sign-message to authenticate the agent into the everything-dev auth plugin — no local key at all, same session surface as bos-auth: 01 bos login — session + scoped FC key export, bos.config.json driven #288.
5. Preview loop: the published custody config is served as a preview runtime (sandbox/preview tier of the host), so an agent can deploy → publish → see it live with zero stored keys.

Acceptance criteria

• An agent with only a wk_ API key can register, whitelist the FastKV contract via policy, and publish a config under its own implicit namespace
• Zero private keys on disk at any point (API key only)
• Policy caps (whitelisted contract, gas/deposit) are enforced before first publish is accepted
• NEP-413 sign-message auth into the auth plugin works headlessly
• publish.auth: "custody" rejects publishing under a named account with a clear error (namespace=signer constraint)
• Preview URL serves the custody-published runtime

Non-goals

• Signing publishes for a named account/org — that is the session-minted delegate key + NEP-366 relay path (bos-auth: 02 gasless wallet publish — bos publish --wallet via NEP-366 relayer #289). Custody wallets cannot sign for accounts they don't own.
• Relayer gas custody (automating the ephemeral relayer's funding) — follow-up once the custody lane is proven.

Blocked by

• bos-auth: 01 bos login — session + scoped FC key export, bos.config.json driven #288 (the publish.auth seam and session surface)