Preserve project scope when deploying from GitHub

[rgarcia]

Summary

deploy github bypassed the authenticated SDK client for its initial multipart POST. It dropped --project / KERNEL_PROJECT, so an organization-scoped credential could create a deployment in the default project before trying to follow it in the selected project.

• Send the existing multipart body through the authenticated client's POST method, preserving project selection, authentication, base URL, and CLI version headers for both creation and event streaming.
• Allow the same OAuth credentials as other deployment commands. Keep creation and event streaming retries disabled.
• Document project-selector precedence and credential restrictions. The global selector already uses X-Kernel-Project for IDs and exact names; no client-side name resolution or SDK upgrade is needed.

Validation

• Local HTTP fixtures cover IDs and names via flag/environment, precedence, absent selection, legacy name delimiters, SDK subservices, project-scoped OAuth credentials, 403/404 propagation, and no retry after a creation 500.
• Confirmed the project-header regression tests fail against main and pass with this fix.
• make test (including go vet ./...) and make build: pass.
• go test -race ./cmd -run 'Test(ProjectSelectionHeaders|DeployGithubProjectScope)$' -count=1: pass.
• golangci-lint run --new-from-merge-base=main: no new issues. Unfiltered lint remains non-green due to existing repository findings.
• No live Kernel API requests; project resolution and credential authorization are server-side contracts, not reimplemented by the fixtures.