feat(hrafn): author the CI deploy that replaces the hand-rsync path

hrafn was handed to infra-ops for uptime ownership with no CI deploy and
no commit provenance -- the image was always local/hrafn:v1 and the whole
working tree lived in the compose directory.

These two files fix both. They are authored here because infra-ops owns
hrafn's uptime, but they belong in vh/hrafn; claude-bot is not a
collaborator there, so they are handed to the repo holder rather than
committed directly.

- playbooks-deploy.yaml -> vh/hrafn playbooks/deploy.yaml
- gitea-workflows-deploy.yaml -> vh/hrafn .gitea/workflows/deploy.yaml

Design calls recorded in the README: the build context travels as one
tarball rather than per-file upload steps (nevermore's pattern fails open
when a new source file has no matching step), and the playbook refuses to
deploy unless .env exists at 0600 -- a guard prompted by it arriving 0644
with a live bearer token in it.

Validated with `elway --dry-run`, which caught a real interpolation bug
during authoring. No new Actions secrets needed.

stacks/hrafn/ci/playbooks-deploy.yaml

@@ -0,0 +1,109 @@
+# Deploy hrafn (fleet browser-fetch service) to a Docker host.
+#
+# Single source of truth for "how hrafn is deployed" — CI and manual runs
+# take the same path. Modelled on nevermore's playbook, with two deliberate
+# differences noted below.
+#
+# Usage (from this repo's root):
+#   elway <host> --playbook playbooks/deploy.yaml
+#
+# Requires a build-context tarball at dist/hrafn-context.tgz. The CI
+# workflow builds it; for a manual run, build it the same way:
+#   mkdir -p dist && tar czf dist/hrafn-context.tgz \
+#     Dockerfile compose.yaml pyproject.toml README.md src
+#
+# DIFFERENCE 1 — tarball instead of per-file upload steps. nevermore
+# enumerates every source file as its own upload step. That is explicit,
+# but it fails OPEN: add a new src/hrafn/*.py and forget the matching
+# step, and the deploy silently ships without it. hrafn's build context
+# is a whole package, so it travels as one archive and cannot go partial.
+#
+# DIFFERENCE 2 — the image is tagged with the commit SHA, not a fixed
+# `v1`. Before this, nothing on the host could answer "what is running";
+# now the image tag IS the answer, and rolling back is retagging.
+#
+# NOT DEPLOYED BY THIS PLAYBOOK: .env. It is host-owned, 0600, and holds
+# the bearer token. Uploading it would either clobber the live token or
+# leak it into the repo. It is provisioned once by hand from the vault
+# item `ana-docker/hrafn/bearer-token`.
+
+vars:
+  compose_dir: /opt/docker/compose/hrafn
+  # Overridden by CI with the triggering commit. `manual` marks a
+  # hand-run deploy so an un-provenanced image is obvious on the host.
+  hrafn_sha: manual
+
+steps:
+  # ── preconditions ───────────────────────────────────────────────────
+
+  - name: Verify compose dir exists + writable
+    shell: test -w {{ compose_dir }}
+    changed_when: "false"
+
+  - name: Verify .env is present and 0600 (deploy must not create it)
+    shell: |
+      test -f {{ compose_dir }}/.env || { echo "MISSING .env — provision it from vault item ana-docker/hrafn/bearer-token"; exit 1; }
+      perms=$(stat -c %a {{ compose_dir }}/.env)
+      test "$perms" = "600" || { echo "REFUSING: .env is $perms, expected 600 (it holds the bearer token)"; exit 1; }
+    changed_when: "false"
+
+  - name: Verify traefik-net exists (consumers reach hrafn on it)
+    shell: docker network inspect traefik-net >/dev/null 2>&1
+    changed_when: "false"
+
+  # ── ship the build context ──────────────────────────────────────────
+
+  - name: Upload build context
+    upload:
+      src: dist/hrafn-context.tgz
+      dest: "{{ compose_dir }}/.hrafn-context.tgz"
+      mode: "0600"
+
+  - name: Unpack build context
+    # Overwrites tracked files in place; leaves .env and any host-only
+    # state alone because the archive does not contain them.
+    shell: tar xzf {{ compose_dir }}/.hrafn-context.tgz -C {{ compose_dir }} && rm -f {{ compose_dir }}/.hrafn-context.tgz
+
+  # ── build + start ───────────────────────────────────────────────────
+
+  - name: Build image tagged with the commit
+    shell: cd {{ compose_dir }} && HRAFN_TAG={{ hrafn_sha }} docker compose build
+
+  - name: Start/replace the container on the new image
+    shell: cd {{ compose_dir }} && HRAFN_TAG={{ hrafn_sha }} docker compose up -d
+
+  - name: Record what is deployed
+    # The provenance fix. Anyone on the box can now answer "what commit
+    # is this" without asking the person who last rsync'd.
+    shell: |
+      printf 'sha=%s\ndeployed_at=%s\n' "{{ hrafn_sha }}" "$(date -Is)" > {{ compose_dir }}/.deployed
+      chmod 644 {{ compose_dir }}/.deployed
+
+verify:
+  - name: Container reports healthy
+    # start_period is 20s and the interval is 30s, so allow two cycles
+    # before calling it a failure rather than a slow start.
+    shell: |
+      # elway's variable regex only matches an identifier starting with a
+      # letter or underscore, so docker's .State Go template below passes
+      # through untouched and needs no escaping.
+      for i in $(seq 1 20); do
+        s=$(docker inspect hrafn --format '{{.State.Health.Status}}' 2>/dev/null || echo missing)
+        [ "$s" = "healthy" ] && { echo "healthy after ${i}0s"; exit 0; }
+        sleep 10
+      done
+      echo "still $s after 200s"; docker logs --tail 40 hrafn; exit 1
+    changed_when: "false"
+
+  - name: Readiness endpoint answers on the shared network
+    # Proves consumers can actually reach it, not just that the process
+    # is up — hrafn has no published host port, so this has to run from
+    # inside traefik-net.
+    shell: >
+      docker run --rm --network traefik-net curlimages/curl:latest
+      -sf -m 10 -o /dev/null -w '%{http_code}\n' http://hrafn:8080/readyz
+    changed_when: "false"
+
+  - name: Deployed SHA matches what we just shipped
+    shell: grep -q "^sha={{ hrafn_sha }}$" {{ compose_dir }}/.deployed
+    changed_when: "false"