Match the deploy system to hops and greatbear

menu-admin was the odd one out: it built from the working directory with a date
tag and a multi-arch manifest, deployed with `-e tag=`, and kept the Docker-era
container name. The other two apps build from `git archive HEAD` and tag with the
commit, so what runs on the host is exactly what git knows about; build only for
the architecture emily actually runs; and use one slug for the container, its
network and its data directory.

The build is now their three lines: `podman build --platform linux/arm64` from
`git archive HEAD`, tagged `:<commit>` and `:latest`, pushed with `podman push`
rather than a manifest. `deploy.sh` pushes the commit first, then refuses a dirty
tracked tree or a HEAD that is not origin/main — which is what makes the commit
tag trustworthy — takes the same `--force` and `--no-push`, and ends in the same
`-u tanshu ... -e image_tag=<commit>`. Its own lint/typecheck/test gate stays,
but behind `--checks`, so a plain deploy behaves as theirs does.

The registry credential moves into vars/default.yml and the role logs in, pulls
and logs out around it, as their roles do. The image is only pulled at deploy
time, so the unit keeps podman's default `Pull=missing` and a reboot never needs
the registry. This is the same plaintext credential the other two repos carry.

One real bug goes with it: the healthcheck gate ran before the handler that
restarts a changed unit, so a run that only changed the unit checked the stale
container. `meta: flush_handlers` before the gate is the fix the sibling repos
already made.

The container, network and data directory are all menu-<site> now. The dotted
Docker-era name and the NetworkAlias it needed are gone, so `podman logs
menu-<site>` and `systemctl --user status menu-<site>` are the same two commands
across all three apps. The Dockerfile keeps its name for the same reason: podman
reads it as readily as a Containerfile, and the siblings use that name too.

ansible/playbook.yml

@@ -1,23 +1,24 @@
 ---
 # Deploys the menu app for one or more Sites as rootless Podman Quadlet units on
-# emily, behind the shared Caddy unit that ansible-playbooks/caddy owns. It lives
-# here, beside the app it deploys, and is run from this directory:
-#
-#   ./deploy.sh <tag>                                            (repo root)
-#   ansible-playbook --inventory=hosts playbook.yml --limit hopsngrains -e tag=<tag>
+# emily, behind the fleet's shared Caddy unit (caddy/playbook.yml in the
+# ansible-playbooks repo). It lives here, beside the app it deploys.
 #
 # Connects as the container user and runs everything as that user: the Quadlet
 # units belong to it, so the connection's PAM session is what makes
-# `systemctl --user` work without any environment juggling.
+# `systemctl --user` and `podman exec` work without any environment juggling.
+# There is deliberately no `become`: root-only prerequisites (Podman,
+# `loginctl enable-linger`, the low-port sysctl Caddy needs) belong to
+# caddy/playbook.yml, which must have run on this host first.
 #
-# gather_facts is required: podman_user and the home directory come from the
-# user_id / user_dir facts.
+# gather_facts is required: podman_user, podman_data_dir and quadlet_dir are
+# derived from the user_id / user_dir facts.
 #
-# The rootless-Podman prerequisites (installing podman, enabling lingering, the
-# low-port sysctl, creating the Quadlet directory) are deliberately NOT applied
-# here. They are the shared task file at
-# ansible-playbooks/caddy/roles/podman/tasks/main.yaml, and a host that has
-# already run ansible-playbooks/caddy/playbook.yml has them.
+# The inventory is the one difference from the sibling apps, which deploy a
+# single app: this play carries three Sites and a var_file per Site.
+#
+#   ./deploy.sh                                     (repo root)
+#   SITE=greatbear ./deploy.sh                      one Site
+#   cd ansible && ansible-playbook -u tanshu --inventory=hosts playbook.yml -e image_tag=<commit>
 - name: Deploy the menu app as rootless Podman Quadlets
   hosts: menus
   gather_facts: true