bootstrap.yml prepares a host as an admin via -u; new-deploy-key.sh makes the
key pair and refuses to write inside the repo. CI deploys refuse the bootstrap
playbook, since the dispatch API ignores the dropdown.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
check.sh is the full static gate and the single source of the tool version
pins, which CI reads with --print-specs so a workflow cannot drift from what
runs locally. load-ssh-key.sh is the only thing that knows where the deploy
key comes from — file, CI secret, or Vault — and prints a path, never key
material.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
