Match the deploy system to hops and greatbear

menu-admin was the odd one out: it built from the working directory with a date
tag and a multi-arch manifest, deployed with `-e tag=`, and kept the Docker-era
container name. The other two apps build from `git archive HEAD` and tag with the
commit, so what runs on the host is exactly what git knows about; build only for
the architecture emily actually runs; and use one slug for the container, its
network and its data directory.

The build is now their three lines: `podman build --platform linux/arm64` from
`git archive HEAD`, tagged `:<commit>` and `:latest`, pushed with `podman push`
rather than a manifest. `deploy.sh` pushes the commit first, then refuses a dirty
tracked tree or a HEAD that is not origin/main — which is what makes the commit
tag trustworthy — takes the same `--force` and `--no-push`, and ends in the same
`-u tanshu ... -e image_tag=<commit>`. Its own lint/typecheck/test gate stays,
but behind `--checks`, so a plain deploy behaves as theirs does.

The registry credential moves into vars/default.yml and the role logs in, pulls
and logs out around it, as their roles do. The image is only pulled at deploy
time, so the unit keeps podman's default `Pull=missing` and a reboot never needs
the registry. This is the same plaintext credential the other two repos carry.

One real bug goes with it: the healthcheck gate ran before the handler that
restarts a changed unit, so a run that only changed the unit checked the stale
container. `meta: flush_handlers` before the gate is the fix the sibling repos
already made.

The container, network and data directory are all menu-<site> now. The dotted
Docker-era name and the NetworkAlias it needed are gone, so `podman logs
menu-<site>` and `systemctl --user status menu-<site>` are the same two commands
across all three apps. The Dockerfile keeps its name for the same reason: podman
reads it as readily as a Containerfile, and the siblings use that name too.

Makefile

@@ -1,23 +1,42 @@
+# menu-admin — container image builds.
+#
+# Built with Podman/Buildah, not Docker, from the committed tree
+# (`git archive HEAD`) and tagged with that commit, so a deploy ships exactly
+# what git knows about. deploy.sh pushes first and refuses a dirty tree.
+
+COMMIT ?= $(shell git rev-parse --short HEAD)
+
+# The deploy host (emily) is aarch64, so that is the default target: the image
+# is built for the machine it runs on, not the one running make. Podman carries
+# no built-in QEMU (unlike docker buildx), so a foreign platform needs binfmt
+# handlers on this host — qemu-user-binfmt is installed here. Override with e.g.
+# `make build-production PLATFORM=linux/amd64`.
+PLATFORM ?= linux/arm64
+
 IMAGE ?= registry.tanshu.com/menu-admin
-PLATFORMS ?= linux/amd64,linux/arm64
 
-.PHONY: build-production build-check build-check-local
+.PHONY: build-production
+build-production: ## Build HEAD with podman, tag :$(COMMIT) + :latest, and push
+	@echo "==> podman build --platform $(PLATFORM) → $(IMAGE):$(COMMIT) + :latest"
+	@git archive --format=tar HEAD | podman build \
+		--platform $(PLATFORM) \
+		--tag $(IMAGE):$(COMMIT) \
+		--tag $(IMAGE):latest \
+		--pull=always \
+		- || { \
+		echo "✗ podman build failed."; \
+		echo "  Cross-platform builds need binfmt on this host (podman has no built-in QEMU):"; \
+		echo "    sudo apt install qemu-user-binfmt  # or qemu-user-static"; \
+		exit 1; \
+	}
+	podman push $(IMAGE):$(COMMIT)
+	podman push $(IMAGE):latest
 
-# Mirrors the other apps on this machine: a podman manifest build, so one tag
-# carries both architectures, pushed to the private registry.
-build-production: ## Build and push the production image. Usage: make build-production TAG=2026-09-22
-	@test -n "$(TAG)" || { echo "Usage: make build-production TAG=2026-09-22" >&2; exit 1; }
-	@echo "Building image..."
-	@podman manifest rm $(IMAGE):latest 2>/dev/null || true
-	@podman build --platform $(PLATFORMS) --manifest $(IMAGE):latest --pull .
-	@echo "Pushing manifests..."
-	@podman manifest push --all $(IMAGE):latest docker://$(IMAGE):latest
-	@podman manifest push --all $(IMAGE):latest docker://$(IMAGE):$(TAG)
-
-build-check: ## Multi-arch build without pushing, to prove both platforms build
-	@podman manifest rm menu-admin:check 2>/dev/null || true
-	@podman build --platform $(PLATFORMS) --manifest menu-admin:check --pull .
-
-build-check-local: ## Single-arch build without pushing: the quick local check
-	@podman manifest rm menu-admin:check 2>/dev/null || true
-	@podman build --platform linux/amd64 --manifest menu-admin:check .
+.PHONY: build-check
+build-check: ## Compile check from HEAD with podman, nothing pushed
+	@echo "==> podman build --platform $(PLATFORM) (no push)"
+	git archive --format=tar HEAD | podman build \
+		--platform $(PLATFORM) \
+		--tag localhost/menu-admin:check \
+		--pull=always \
+		-