Match the deploy system to hops and greatbear

menu-admin was the odd one out: it built from the working directory with a date
tag and a multi-arch manifest, deployed with `-e tag=`, and kept the Docker-era
container name. The other two apps build from `git archive HEAD` and tag with the
commit, so what runs on the host is exactly what git knows about; build only for
the architecture emily actually runs; and use one slug for the container, its
network and its data directory.

The build is now their three lines: `podman build --platform linux/arm64` from
`git archive HEAD`, tagged `:<commit>` and `:latest`, pushed with `podman push`
rather than a manifest. `deploy.sh` pushes the commit first, then refuses a dirty
tracked tree or a HEAD that is not origin/main — which is what makes the commit
tag trustworthy — takes the same `--force` and `--no-push`, and ends in the same
`-u tanshu ... -e image_tag=<commit>`. Its own lint/typecheck/test gate stays,
but behind `--checks`, so a plain deploy behaves as theirs does.

The registry credential moves into vars/default.yml and the role logs in, pulls
and logs out around it, as their roles do. The image is only pulled at deploy
time, so the unit keeps podman's default `Pull=missing` and a reboot never needs
the registry. This is the same plaintext credential the other two repos carry.

One real bug goes with it: the healthcheck gate ran before the handler that
restarts a changed unit, so a run that only changed the unit checked the stale
container. `meta: flush_handlers` before the gate is the fix the sibling repos
already made.

The container, network and data directory are all menu-<site> now. The dotted
Docker-era name and the NetworkAlias it needed are gone, so `podman logs
menu-<site>` and `systemctl --user status menu-<site>` are the same two commands
across all three apps. The Dockerfile keeps its name for the same reason: podman
reads it as readily as a Containerfile, and the siblings use that name too.

README.md

@@ -17,17 +17,24 @@ and moving DNS, which needs a human present.
 ## Deploying
 
 ```sh
-./deploy.sh 2026-09-22                 # format, types, tests, podman build+push, deploy
-SKIP_DEPLOY=1 ./deploy.sh 2026-09-22   # build and push only
+./deploy.sh                  # push, build <commit>, deploy every Site to emily
+./deploy.sh --no-push        # skip the push (you already pushed)
+./deploy.sh --force          # skip the guards
+./deploy.sh --checks         # lint, format, typecheck and test first
+SITE=greatbear ./deploy.sh   # one Site instead of every Site
 ```
 
-The image is built with **podman** as a multi-arch manifest and pushed to
-`registry.tanshu.com/menu-admin` (`Makefile`, mirrored from the other apps on
-this machine). The Ansible deployment lives in `ansible/` in this repo, with one
-inventory entry per Site. It writes a rootless Podman **Quadlet** unit per Site
-and appends the Site's block to the shared Caddyfile, exactly as the sibling
-services in `ansible-playbooks` do; see `ansible/readme.md` for how a deploy runs
-and how to roll one back.
+The image is built with **Podman/Buildah** (not Docker) from the committed tree
+(`git archive HEAD`) and tagged with its **commit id**, so what runs on the host
+is exactly what git knows about; `deploy.sh` refuses a dirty tracked tree and
+requires `HEAD == origin/main`. It is built for **linux/arm64** because `emily`
+is aarch64, and pushed to `registry.tanshu.com/menu-admin`.
+
+The Ansible deployment lives in `ansible/` in this repo, with one inventory entry
+per Site. It writes a rootless Podman **Quadlet** unit per Site and appends the
+Site's block to the shared Caddyfile, exactly as the sibling `hops` and
+`greatbear` apps do; see `ansible/readme.md` for how a deploy runs and how to
+roll one back.
 
 ## Layout
 
@@ -50,9 +57,9 @@ test/                     node:test suites
 docs/plan.md              The agreed plan
 docs/operating.md         Publishing, fixing and rolling back, for whoever operates it
 docs/adr/                 Decisions worth remembering
-Containerfile             The image, built by podman
+Dockerfile                The image, built by podman
 compose.yaml              Local dev: podman compose
-deploy.sh                 Tests, build, push, deploy
+deploy.sh                 Build HEAD, push it, deploy it
 ansible/                  The deployment: one rootless Quadlet unit per Site
 ```