Add opt-in Alchemy deployment for the Cloudflare host

[magoz]

What

Adds an opt-in Alchemy v2 deployment path for the existing Cloudflare host while keeping Wrangler as the default:

• introduces a separate host-cloudflare-alchemy workspace so Alchemy can use its required Effect version without upgrading Executor's runtime Effect dependency;
• deploys the existing async Worker entry, D1/R2 resources, SQLite Durable Object classes, assets, variables, and redacted encryption key with the current production names and bindings;
• adds isolated validation commands, adoption-aware production commands, shared remote-state bootstrap/authentication helpers, and explicit adoption safeguards;
• supplies a deterministic content hash for built assets so fresh-build plans converge instead of conservatively updating the Worker every time;
• exports the Cloudflare Worker through the package boundary and documents fresh deployment, validation, CI authentication, adoption, and the EXECUTOR_SECRET_KEY/keep_bindings risks.

Cloudflare Access remains an external prerequisite with the pinned Alchemy release. Managed OAuth Access application support is being added upstream in alchemy-run/alchemy#1023.

Verification

• bun run format:check
• bun run lint
• bun run typecheck
• bun run --cwd apps/host-cloudflare test (23 tests)
• bun run --cwd apps/host-cloudflare build
• two fresh builds produced the same asset-directory hash
• post-deploy plan:alchemy:validation: D1, R2, and Worker all no-op
• isolated live deployment behind Cloudflare Access: authenticated UI/account API, QuickJS execution, D1/R2-backed OpenAPI lifecycle, MCP initialization/tool execution/termination, cross-session Durable Object pause/resume, and OAuth discovery/challenge behavior

TURBO_TEST_CONCURRENCY=4 bun run test exits successfully. Its unchanged apps/cloud/src/account/org-api-key-revoke.node.test.ts currently reports three pre-existing assertions caused by calls that omit the required organization selector header; the scoped Cloudflare host suite is green.