Add the host bootstrap: deploy user, key, docker access, stack root

bootstrap.yml prepares a host as an admin via -u; new-deploy-key.sh makes the
key pair and refuses to write inside the repo. CI deploys refuse the bootstrap
playbook, since the dispatch API ignores the dropdown.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/deploy.yml

@@ -97,6 +97,10 @@ jobs:
           set -eu
           case "$STACK" in
             ''|*[!a-z0-9_-]*) echo "refusing STACK='$STACK'"; exit 1 ;;
+            # Has a playbook, so the test -f below would pass it, but it must
+            # run as an administrator — see docs/bootstrap.md. The dropdown
+            # leaves it out; the API does not.
+            bootstrap) echo "refusing STACK='$STACK': run it by hand"; exit 1 ;;
           esac
           case "$MODE" in
             check|sync|deploy) ;;