bundle: add --deploy-apps to push source code during bundle deploy

[jamesbroadhead]

Summary

Addresses the DEPLOY-01 "bundle deploy does not actually deploy apps" gap surfaced in the internal EMEA Apps gaps doc (number 1 developer complaint from — the first-five-minutes experience).

Today bundle deploy only reconciles resources via the terraform/direct engine; the app source code is pushed by a separate bundle run <app> step. Users routinely miss step 2 and conclude the platform is broken when their "deployed" app does nothing new.

With --deploy-apps, the Deploy phase calls w.Apps.Deploy() for every app in the bundle after the resource CRUD completes. The flag defaults to false to preserve existing behavior for users and CI pipelines that rely on the two-step flow; once the flag proves out in the field we can flip the default.

Changes

• bundle/appdeploy/config.go — factor the ${resources.*} reference resolution out of appRunner.resolvedConfig() into a package-level ResolveAppConfig. Takes *config.Root (not *bundle.Bundle) to avoid the bundle → direct → dresources → appdeploy import cycle.
• bundle/phases/deploy_apps.go — new DeployApps phase. Iterates b.Config.Resources.Apps, resolves config, calls appdeploy.Deploy per app. Accumulates per-app errors via errors.Join so one failed app does not mask the others.
• bundle/phases/deploy.go — call DeployApps at the end of the deploy phase (after the core mutator, before ScriptPostDeploy), gated on b.DeployApps.
• bundle/bundle.go — new DeployApps bool alongside AutoApprove.
• cmd/bundle/deploy.go — wire the --deploy-apps flag through ProcessOptions.InitFunc.
• bundle/run/app.go — replace the in-line resolvedConfig method with a call to the new package-level helper so both code paths share the same resolution behavior.
• bundle/appdeploy/config_test.go — unit coverage for the nil / no-config cases.

Test plan

• go build ./... passes (including the no-import-cycle check that initially flagged my first draft)
• go test ./bundle/appdeploy/... ./bundle/phases/... ./bundle/run/... ./cmd/bundle/... passes
• make fmt clean
• Integration test that deploys a bundle with an app and asserts source ends up at the workspace path (follow-up)
• Acceptance test with a fixture bundle containing an apps: resource (follow-up)

Follow-ups explicitly out of scope

• Default flip: tie to a release where the behavior is documented as the new expectation.
• A deeper dyn.Value-driven unit test for ResolveAppConfig (requires setting up a populated config.Root via the standard bundle load path).
• Error-reporting shape when an app's compute is not yet running — the existing appdeploy.Deploy retries on in-progress deployments; there may be additional pre-conditions worth surfacing here.

This pull request and its description were written by Claude (claude.ai).

[github-actions]

An authorized user can trigger integration tests manually by following the instructions below:

Trigger:
go/deco-tests-run/cli

Inputs:

• PR number: 5055
• Commit SHA: c83e95dd2fc37be08ade51fe17b64632c97168be

Checks will be approved automatically on success.

[github-actions]

Approval status: pending

/bundle/ - needs approval

7 files changed
Suggested: @denik
Also eligible: @andrewnester, @shreyas-goenka, @pietern, @lennartkats-db, @anton-107, @janniklasrose

/cmd/bundle/ - needs approval

Files: cmd/bundle/deploy.go
Suggested: @denik
Also eligible: @andrewnester, @shreyas-goenka, @pietern, @lennartkats-db, @anton-107, @janniklasrose

_{Any maintainer (@andrewnester, @anton-107, @denik, @pietern, @shreyas-goenka, @simonfaltum, @renaudhartert-db) can approve all areas.
See OWNERS for ownership rules.}