Add guard rails for several agents working on the repo at once

Deploys from unpushed branches were being reverted by the next deploy
from main, and in-place vault edits could overwrite each other.

- deploy-guard.yml (imported by site.yml and dns.yml) refuses real runs
  unless the checkout is clean and exactly origin/main; --check is fine.
- bin/deploy holds a lock so only one deploy runs at a time.
- bin/vault-run edits the vault under a lock with an atomic swap.
- bin/worktree starts a task in a fresh worktree from origin/main.
- CLAUDE.md explains the workflow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

bin/deploy

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Run a playbook while holding the deploy lock, so only one agent deploys at a
+# time. Arguments go straight to ansible-playbook.
+#   bin/deploy --tags gitea            (site.yml)
+#   bin/deploy --check --diff
+#   PLAYBOOK=dns.yml bin/deploy
+# Real runs only work from a clean checkout of origin/main (deploy-guard.yml).
+set -euo pipefail
+. "$(dirname "$0")/_common.sh"
+link_vault
+take_lock deploy
+cd "$repo"
+"$main_checkout/.venv/bin/ansible-playbook" "${PLAYBOOK:-site.yml}" -i hosts.yml \
+    --vault-password-file "$main_checkout/vault_pass" "$@"