Deploy: push before building, and tag images with the commit

deploy.sh no longer needs a manual push before it, and no made-up tag:

- It pushes the current branch, refuses a dirty tracked tree, and requires
  HEAD == origin/main before anything is built, so the image can only be
  built for a commit the remote actually has. --force and --no-push skip the
  guards.
- The image is tagged :<commit> as well as :latest, and ansible takes
  -e image_tag=<commit>, so a deploy pins the exact revision; rollback is the
  same play with an older commit.
- Makefile builds `git archive HEAD` instead of cloning the remote (the push
  guard makes the local commit the remote state) and defaults PLATFORM to
  linux/arm64, because emily is aarch64 — the same default mozimo uses. Drop
  build-check-local; build-check already builds the committed tree.

Makefile

@@ -1,63 +1,42 @@
 # The Great Bear — container image builds.
 #
-# Built with Podman/Buildah, not Docker. The image is always built from a fresh
-# clone of the git remote, so it matches a pushed commit; commit and push before
-# deploying. Registry credentials: `podman login registry.tanshu.com` once per
-# machine (nothing here prompts).
+# Built with Podman/Buildah, not Docker, from the committed tree
+# (`git archive HEAD`) and tagged with that commit, so a deploy ships exactly
+# what git knows about. deploy.sh pushes first and refuses a dirty tree.
+
+COMMIT ?= $(shell git rev-parse --short HEAD)
+
+# The deploy host (emily) is aarch64, so that is the default target: the image
+# is built for the machine it runs on, not the one running make. Podman carries
+# no built-in QEMU (unlike docker buildx), so a foreign platform needs binfmt
+# handlers on this host — qemu-user-binfmt is installed here. Override with e.g.
+# `make build-production PLATFORM=linux/amd64`.
+PLATFORM ?= linux/arm64
 
 IMAGE ?= registry.tanshu.com/tanshu/greatbear
-REPO  ?= git@git.tanshu.com:tanshu/greatbear.git
-TAG   ?= latest
-
-# Target platform. Defaults to the architecture of the machine running make,
-# which is what a native `podman build` would use anyway. Only cross-build when
-# the deploy host differs, e.g.:
-#
-#   make build-production PLATFORM=linux/arm64
-#
-# Cross-building needs QEMU binfmt registered on the controller
-# (qemu-user-static), the same requirement `docker buildx --platform` had.
-PLATFORM ?= linux/$(shell uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/' -e 's/armv7l/arm/')
 
 .PHONY: build-production
-build-production: ## Build the image with podman from the git remote and push it
-	@set -euo pipefail; \
-	ctx="$$(mktemp -d)"; \
-	trap 'rm -rf "$$ctx"' EXIT; \
-	echo "==> cloning $(REPO)"; \
-	git clone --quiet --depth 1 "$(REPO)" "$$ctx/src"; \
-	echo "==> podman build --platform $(PLATFORM) -t $(IMAGE):$(TAG)"; \
-	podman build --pull=always --platform "$(PLATFORM)" \
-		-t "$(IMAGE):$(TAG)" \
-		-f "$$ctx/src/Dockerfile" "$$ctx/src"; \
-	echo "==> podman push $(IMAGE):$(TAG)"; \
-	podman push "$(IMAGE):$(TAG)"; \
-	if [ "$(TAG)" != "latest" ]; then \
-		echo "==> podman push $(IMAGE):latest"; \
-		podman tag "$(IMAGE):$(TAG)" "$(IMAGE):latest"; \
-		podman push "$(IMAGE):latest"; \
-	fi
+build-production: ## Build HEAD with podman, tag :$(COMMIT) + :latest, and push
+	@echo "==> podman build --platform $(PLATFORM) → $(IMAGE):$(COMMIT) + :latest"
+	@git archive --format=tar HEAD | podman build \
+		--platform $(PLATFORM) \
+		--tag $(IMAGE):$(COMMIT) \
+		--tag $(IMAGE):latest \
+		--pull=always \
+		- || { \
+		echo "✗ podman build failed."; \
+		echo "  Cross-platform builds need binfmt on this host (podman has no built-in QEMU):"; \
+		echo "    sudo apt install qemu-user-binfmt  # or qemu-user-static"; \
+		exit 1; \
+	}
+	podman push $(IMAGE):$(COMMIT)
+	podman push $(IMAGE):latest
 
 .PHONY: build-check
-build-check: ## Build from the git remote without pushing (compile check)
-	@set -euo pipefail; \
-	ctx="$$(mktemp -d)"; \
-	trap 'rm -rf "$$ctx"' EXIT; \
-	echo "==> cloning $(REPO)"; \
-	git clone --quiet --depth 1 "$(REPO)" "$$ctx/src"; \
-	echo "==> podman build --platform $(PLATFORM) greatbear:test"; \
-	podman build --pull=always --platform "$(PLATFORM)" \
-		-t localhost/greatbear:test \
-		-f "$$ctx/src/Dockerfile" "$$ctx/src"
-
-.PHONY: build-check-local
-build-check-local: ## Build the committed local tree (git archive) without pushing
-	@set -euo pipefail; \
-	ctx="$$(mktemp -d)"; \
-	trap 'rm -rf "$$ctx"' EXIT; \
-	mkdir -p "$$ctx/src"; \
-	git archive --format=tar HEAD | tar -x -C "$$ctx/src"; \
-	echo "==> podman build --platform $(PLATFORM) greatbear:test (local HEAD)"; \
-	podman build --pull=always --platform "$(PLATFORM)" \
-		-t localhost/greatbear:test \
-		-f "$$ctx/src/Dockerfile" "$$ctx/src"
+build-check: ## Compile check from HEAD with podman, nothing pushed
+	@echo "==> podman build --platform $(PLATFORM) (no push)"
+	git archive --format=tar HEAD | podman build \
+		--platform $(PLATFORM) \
+		--tag localhost/greatbear:check \
+		--pull=always \
+		-