[nostory] move docker ansible logic to provision playbook

• geerlingguy's docker logic is non-idempotent and takes a long time, so don't run it every deploy
• instead run it once in provision step