bos-auth: 04 custody preview environment — Outlayer custody wallet publish via publish.auth: "custody" seam

Start with issue #288's publish.auth seam and session surface, then review the Outlayer custody endpoints named here: /register, /wallet/v1/call, and /wallet/v1/sign-message. Confirm how the CLI stores the wk_ API key and handles policy handoff before implementing the custody publish path. Done means the acceptance criteria pass, including implicit-namespace publishing, policy enforcement, headless NEP-413 auth, named-account rejection, and a working preview URL.

Sprout of #274 (v2 platform services spec); sibling of #288/#289 in the gasless-auth sprint. Builds on the publish.auth seam from #288.

What to build

A custody preview environment for agents and workshop attendees: a publish identity with zero key exposure, powered by Outlayer agent custody.

1. publish.auth: "custody" credential kind (seam reserved in #288) becomes real: bos login --custody (or auto-provision on first publish) calls Outlayer POST /register once to mint a custody wallet (API key wk_... + TEE-derived implicit NEAR account). The API key is stored in .bos/ (gitignored).
2. Policy handoff: on registration the CLI opens the Outlayer dashboard handoff URL so the wallet owner whitelists the FastKV registry contract with per-transaction gas/deposit caps (mirrors the relayer whitelist posture). Publishing is blocked until policy is confirmed.
3. Publish path: bos publish under the custody credential routes the FastKV set_values write through Outlayer POST /wallet/v1/call — signed inside the TEE, broadcast by the CLI. Publishes land under the custody wallet's own implicit namespace (bos://<implicit-account>/<gateway>), never a named account/org.
4. Headless NEP-413 auth: use Outlayer POST /wallet/v1/sign-message to authenticate the agent into the everything-dev auth plugin — no local key at all, same session surface as #288.
5. Preview loop: the published custody config is served as a preview runtime (sandbox/preview tier of the host), so an agent can deploy → publish → see it live with zero stored keys.

Acceptance criteria

• An agent with only a wk_ API key can register, whitelist the FastKV contract via policy, and publish a config under its own implicit namespace
• Zero private keys on disk at any point (API key only)
• Policy caps (whitelisted contract, gas/deposit) are enforced before first publish is accepted
• NEP-413 sign-message auth into the auth plugin works headlessly
• publish.auth: "custody" rejects publishing under a named account with a clear error (namespace=signer constraint)
• Preview URL serves the custody-published runtime

Non-goals

• Signing publishes for a named account/org — that is the session-minted delegate key + NEP-366 relay path (#289). Custody wallets cannot sign for accounts they don't own.
• Relayer gas custody (automating the ephemeral relayer's funding) — follow-up once the custody lane is proven.

Blocked by

• #288 (the publish.auth seam and session surface)