Deploy via the tb CLI binary instead of /v1/deploy

[sandshoes]

Summary

• Adds src/cli-binary/: platform detection, manifest fetch, download + sha256-verify + extract + cache, and a spawn wrapper for the tb CLI binary published by analytics!23765 (PROTM-471).
• deployToMain() now submits deployments via tb deployment create --no-wait --output json instead of POSTing to /v1/deploy directly. The SDK keeps its own status polling and progress callbacks (the binary's own --wait would block without giving us anything to drive callbacks from), and keeps stale-deployment cleanup as a direct HTTP step (confirmed the CLI's create_deployment() has no equivalent).
• No HTTP fallback: if the binary can't be resolved (unsupported platform, no network, checksum mismatch), deployToMain returns a clear, specific failure.
• build.ts and branches.ts are untouched on purpose — tb build/tb branch don't have confirmed --output json structured output in the CLI source today, so there's nothing safe to migrate there yet.

Draft status

No tb binary is published yet — the MR that builds it hasn't merged. Everything here is grounded in reading tinybird/analytics@master source (manifest shape, CLI flags/output, deployment_common.py behavior) and tested against a fake binary fixture (src/test/fixtures/fake-tb-cli.mjs, mirroring the Python side's own fake_pyinstaller test pattern), not a real binary. Needs e2e-live verification once binaries are actually published.

Two specific things called out inline in deploy.ts as inferred-not-confirmed and worth re-checking then: what empty-stdout-with-exit-0 means (treated as no_changes) and what empty-stdout-with-nonzero-exit means (treated as a failed --check).

Test plan

• pnpm typecheck clean
• pnpm test:run — 1082 passing; only the 9 e2e/init-build.test.ts failures remain, and those are pre-existing on main (verified via git stash), unrelated to this change
• e2e-live verification against a real tb binary once published