althing-chamber: scaffold deploy stack on ana-docker

Two-service compose (chamber + forseti sidecar daemon) sharing a single
SQLite store via bind-mount under /opt/docker/conf/althing-chamber/data.
eventbus.bridge_from_db is the cross-process glue — forseti's commits
reach chamber's SSE subscribers via the bridge.

Pattern matches task-board's build-on-host deploy:
  - elway playbook clones vh/althing into /opt/docker/build/
  - docker build -t althing-chamber:local . (no registry)
  - playbook uploads compose + seeds .env one-time, brings both
    services up, polls /health
  - Gitea Actions workflow lives in vh/althing; reference copy here.

Internal tooling — host port 7881 (chamber's default of 7878 collides
with task-board). LAN-direct, no Traefik. Container always listens on
8000 internally.

Scaffold will fail to bring the chamber container up healthy until
galdrabok-side commits land:
  - Dockerfile at vh/althing repo root (two-stage: uv-bookworm-slim
    build → python:3.12-slim runtime, locked per open_questions §2
    of the v1 contract).
  - GET /health endpoint on the chamber app (200, no DB read).
  - ALTHING_BIND / ALTHING_PORT env-var support in
    core.cli.chamber_serve / core.chamber.cli (env > config.yaml >
    defaults precedence).

Coordinated via althing thread 01KRMAK7RD7TP6C8DF4KXV31RT.

stacks/althing-chamber/gitea-workflow-deploy.yaml.example

@@ -0,0 +1,91 @@
+# Gitea Actions workflow for althing-chamber.
+#
+# THIS FILE LIVES IN THE VH/ALTHING REPO, NOT HERE.
+# Copy to vh/althing:.gitea/workflows/deploy.yaml and commit.
+# (The canonical copy lives in the althing repo; this file is a
+# reference for what shape the workflow takes.)
+#
+# What it does on every push to main (and on manual workflow_dispatch):
+#   1. Checks out althing itself (the triggering repo).
+#   2. Checks out vh/esh-pfi-infrastructure to pick up the elway
+#      playbook and helper scripts.
+#   3. Configures SSH so elway can reach ana-docker.
+#   4. Runs `scripts/elway ana-docker --playbook playbooks/deploy-althing-chamber.yaml`
+#      pinning to the commit SHA that triggered the workflow.
+#
+# Required Actions secrets (configure under
+# https://gitea.phasefinal.com/vh/althing/settings/actions/secrets,
+# or org-level for reuse across repos):
+#
+#   DEPLOY_SSH_KEY    Private SSH key whose pubkey is in
+#                     ~lkraven/.ssh/authorized_keys on ana-docker.
+#                     Used by the runner to invoke the elway playbook.
+#                     Generate fresh; don't reuse a personal key.
+#
+#   MGMT_REPO_TOKEN   Gitea PAT (read:repository scope) on
+#                     vh/esh-pfi-infrastructure, used to clone the
+#                     management repo. Generate at
+#                     https://gitea.phasefinal.com/-/user/settings/applications.
+
+name: Deploy althing-chamber
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    # `pfi-fleet` matches the central runner on ana-docker. Pin to
+    # `ana-docker` instead if you want to refuse running on a future
+    # site-local runner. The runner's label embeds a default image
+    # (node:20-bookworm-slim) — has node + git out of the box, so
+    # actions/checkout@v4 (a JS action) works without a custom
+    # container. We just apt-install python3 + pyyaml for elway.
+    runs-on: pfi-fleet
+
+    steps:
+      - name: Install playbook prerequisites
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends \
+            python3 python3-yaml openssh-client
+          rm -rf /var/lib/apt/lists/*
+
+      - name: Checkout althing (triggering repo)
+        uses: actions/checkout@v4
+
+      - name: Checkout management repo (eshpfi-management)
+        uses: actions/checkout@v4
+        with:
+          repository: vh/esh-pfi-infrastructure
+          token: ${{ secrets.MGMT_REPO_TOKEN }}
+          path: _mgmt
+
+      - name: Configure SSH to ana-docker
+        run: |
+          mkdir -p ~/.ssh
+          # The DEPLOY_SSH_KEY secret is the full private key contents,
+          # newline-terminated. ssh refuses keys that aren't 0600.
+          printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+
+          # ssh_config alias so elway resolves "ana-docker" the same
+          # way it would on a workstation. accept-new is fine for a
+          # fresh job container — host key gets cached for the lifetime
+          # of this job only.
+          cat > ~/.ssh/config <<'EOF'
+          Host ana-docker
+            HostName 10.250.50.70
+            User lkraven
+            IdentityFile ~/.ssh/id_ed25519
+            StrictHostKeyChecking accept-new
+          EOF
+          chmod 600 ~/.ssh/config
+
+      - name: Deploy althing-chamber (elway playbook, pinned to this commit)
+        working-directory: _mgmt
+        run: |
+          scripts/elway ana-docker \
+            --playbook playbooks/deploy-althing-chamber.yaml \
+            --var ref=${{ github.sha }}