`flow config init` should emit a complete deploy.yaml from a bundle

[abrichr]

This is a product gap, not a copy gap. It was documented in the README copy pass / PR #428 ("docs: clarify governed and multi-app workflow paths", Codex thread "Update README copy surfaces") and left unimplemented.

The README now points operators at a governed path that assumes a complete deploy.yaml already exists:

openadapt-flow certify bundle --config deploy.yaml
openadapt-flow run bundle --profile standard --config deploy.yaml

There is no command that produces that file from a compiled bundle. Removing governed commands from the README is not the solution.

Proposed command

openadapt flow config init bundle --out deploy.yaml

Requirements

• Bind the exact bundle digest and execution backend.
• Generate the required policy, identity, effect, idempotency, and runtime sections.
• Use secret references only; never copy live secrets into the emitted YAML.
• Mark unresolved fields so they cannot be mistaken for completed contracts.
• Fail certification until those required fields are complete.
• Emit deterministic, schema-valid output.
• Cover browser, native, RDP, and Citrix with tests.

Documented path after this lands

1. openadapt flow config init bundle --out deploy.yaml
2. Review and complete the YAML (resolve marked fields, bind secret references).
3. openadapt-flow certify bundle --config deploy.yaml
4. openadapt-flow run bundle --profile standard --config deploy.yaml

Do not treat removal of governed commands from the README as the solution.