Model the build on mozimo and target emily

- Makefile: PLATFORMS, tags :<commit> and :main, build-check with --pull.
- deploy.sh: push, guards, git pull --ff-only, optional --prune, image_tag.
- Replace .containerignore with .dockerignore.
- Add the opt-in image prune to the hops role.
- Tag the Caddyfile task so --skip-tags caddy works before DNS cutover.
- Trim comments and rewrite build and deploy text in plain prose.

ansible/roles/caddy/handlers/main.yaml

@@ -1,27 +1,13 @@
 ---
-# Caddy is its own playbook (caddy/playbook.yml in the ansible-playbooks repo)
-# and a rootless Quadlet unit there. These handlers run as the connection user,
-# so `systemctl --user` and `podman exec` work without any XDG_RUNTIME_DIR
-# juggling.
-
-# Notified by roles/caddy when the Caddyfile changes. A reload keeps existing
-# connections; a restart would briefly drop every hosted site.
-#
-# Note the config path: /etc/caddy/Caddyfile is the mount inside the container,
-# not {{ caddyfile_path }}, which is the host side of it.
+# A reload keeps existing connections. A restart would drop every hosted site.
 - name: Reload Caddy configuration
   ansible.builtin.command: >-
     podman exec {{ caddy_name }} caddy reload --config /etc/caddy/Caddyfile
   changed_when: true
   listen: "Reload Caddy"
 
-# Notified by roles/register when this service's network unit, or the drop-in
-# that attaches Caddy to it, is written. Quadlet has no live equivalent of
-# `docker network connect`, so the container has to be recreated — a brief
-# restart of every hosted site, not just this one.
-#
-# Defined after the reload above so that when both are notified the cheap config
-# reload happens first.
+# Notified when the network drop-in changes. Quadlet cannot add a network to a
+# running container, so Caddy must be recreated.
 - name: Restart Caddy
   ansible.builtin.systemd_service:
     name: "{{ caddy_name }}.service"