Add --dry-run flag

This swaps the output to be input-compatible such that we can verify the results of a deploy, especially our new "filtered deploy" (we can verify that the filtering was warranted, but out-of-band instead of in-band).

This also allows us to do more/better testing (see `.test` changes, especially `test.sh`).

Author: tianon