deploy.sh no longer needs a manual push before it, and no made-up tag:
- It pushes the current branch, refuses a dirty tracked tree, and requires
HEAD == origin/main before anything is built, so the image can only be
built for a commit the remote actually has. --force and --no-push skip the
guards.
- The image is tagged :<commit> as well as :latest, and ansible takes
-e image_tag=<commit>, so a deploy pins the exact revision; rollback is the
same play with an older commit.
- Makefile builds `git archive HEAD` instead of cloning the remote (the push
guard makes the local commit the remote state) and defaults PLATFORM to
linux/arm64, because emily is aarch64 — the same default mozimo uses. Drop
build-check-local; build-check already builds the committed tree.
tanshu
1c78fc5103