Deploy: push before building, and tag images with the commit

deploy.sh no longer needs a manual push before it, and no made-up tag:

- It pushes the current branch, refuses a dirty tracked tree, and requires
  HEAD == origin/main before anything is built, so the image can only be
  built for a commit the remote actually has. --force and --no-push skip the
  guards.
- The image is tagged :<commit> as well as :latest, and ansible takes
  -e image_tag=<commit>, so a deploy pins the exact revision; rollback is the
  same play with an older commit.
- Makefile builds `git archive HEAD` instead of cloning the remote (the push
  guard makes the local commit the remote state) and defaults PLATFORM to
  linux/arm64, because emily is aarch64 — the same default mozimo uses. Drop
  build-check-local; build-check already builds the committed tree.

ansible/vars/default.yml

@@ -19,7 +19,9 @@ registry_password: ff28a01f00c0f39315d94cd9dcb1e554968dba25676a8ea5f2be34e96a9a0
 
 image_name: "{{ registry }}/tanshu/greatbear"
 tag: latest
-image: "{{ image_name }}:{{ tag }}"
+# deploy.sh passes -e image_tag=<commit>; `tag` is the fallback when running the
+# play by hand. Rollback = -e image_tag=<older-commit>.
+image: "{{ image_name }}:{{ image_tag | default(tag) }}"
 
 # ---------------------------------------------------------------------------
 # The Great Bear