Deploy workflow: commit-id image tags, guarded deploy.sh, opt-in prune

- Makefile builds from 'git archive HEAD' (stale-remote-HEAD impossible):
  tags registry.tanshu.com/mozimo:<short-commit> + :main; build-check target
  verifies both architectures without pushing
- deploy.sh: refuses dirty tracked tree / HEAD != origin/main (--force to
  bypass), ff-only pull, passes the commit as image_tag to ansible,
  --prune flag for opt-in image cleanup
- ansible: docker_image uses image_tag extra-var (falls back to tag),
  prune task keeps the 3 newest mozimo images, mozimo-repo only

ansible/vars/default.yml

@@ -12,7 +12,9 @@ host: "staging.mozimo.in"
 
 docker_network: "{{ title }}_net"
 
-docker_image: "{{ registry }}/{{ title }}:{{ tag }}"
+# image tag: deploy.sh passes -e image_tag=<commit>; "tag" is the fallback
+# when running the playbook by hand — rollback = -e image_tag=<older-commit>
+docker_image: "{{ registry }}/{{ title }}:{{ image_tag | default(tag) }}"
 docker_container: "{{ title }}-staging"
 docker_port: 3000