Deploy workflow: commit-id image tags, guarded deploy.sh, opt-in prune

- Makefile builds from 'git archive HEAD' (stale-remote-HEAD impossible):
  tags registry.tanshu.com/mozimo:<short-commit> + :main; build-check target
  verifies both architectures without pushing
- deploy.sh: refuses dirty tracked tree / HEAD != origin/main (--force to
  bypass), ff-only pull, passes the commit as image_tag to ansible,
  --prune flag for opt-in image cleanup
- ansible: docker_image uses image_tag extra-var (falls back to tag),
  prune task keeps the 3 newest mozimo images, mozimo-repo only

ansible/roles/mozimo/tasks/main.yaml

@@ -31,3 +31,10 @@
       - "{{ host_directory }}/pb_data:/app/pb_data"
     networks:
       - name: "{{ docker_network }}"
+
+- name: Prune old mozimo images, keep newest 3 (opt-in via ./deploy.sh --prune)
+  ansible.builtin.shell: >
+    docker images "registry.tanshu.com/mozimo" --format "{{.ID}}" | tail -n +4 | xargs -r docker rmi
+  when: mozimo_image_prune | default(false) | bool
+  failed_when: false
+  changed_when: true