Fix Vercel prune target ownership and improve failure diagnostics - #14

Summary

• Vercel prune ownership: match remote env vars by exact scope.targets (not overlap), so multi-target shared deployments no longer prune sibling production-/preview-only rows. Same rule for project and shared env.
• Provider error visibility: include bounded, secret-redacted provider response detail in SafeError messages, --verbose DEBUG logs (METHOD URL → status: detail), and mutation audit error_message / error_hint.
• Validation context: missing logical-id errors name the deployment and destination (plus a hint).
• Vercel shared PATCH: omit empty projectId on updates (create already did), avoiding 400: No Shared Environment Variables were updated.
• Docs/examples updated for the ownership rule and richer example config.

Test plan

• uv run pytest tests/integration/test_vercel.py tests/unit/test_http_retry.py tests/unit/test_audit.py tests/unit/test_validate_plan.py tests/security/test_canary_channels.py
• Apply with --prune against a Vercel team that has shared vars partitioned as {production}, {preview}, and {production, preview} — confirm no cross-deletes
• Force a provider 4xx with --verbose — confirm CLI/audit show the provider message and DEBUG shows method/URL
• Validate a deployment referencing a logical id missing from its set — confirm error names deployment + destination