v1.4.0: fail-fast fix, DEPLOY_DOTENV only, token strip, empty-services guard