sc: prod deploy tooling

• deploy plan
  • mpv plan:
    • after merge: (gitlab after merge job)
      • (1) build image, tag it with both commit hash and prod
      • (2) dev notices that container has been built, runs make ansible.deploy.friendo from laptop
  • better plan:
    • during ci:
      • build container, tag with last available commit
      • use in subsequent jobs
    • after merge
      • retag container we already built with merge commit and prod
      • CI runs ansible deploy job itself (CI needs an ssh key to box now)
  • even better plan:
    • signalboost has code baked in
    • prod checks for new docker tags and pulls itself