Add guard rails for several agents working on the repo at once

Deploys from unpushed branches were being reverted by the next deploy
from main, and in-place vault edits could overwrite each other.

- deploy-guard.yml (imported by site.yml and dns.yml) refuses real runs
  unless the checkout is clean and exactly origin/main; --check is fine.
- bin/deploy holds a lock so only one deploy runs at a time.
- bin/vault-run edits the vault under a lock with an atomic swap.
- bin/worktree starts a task in a fresh worktree from origin/main.
- CLAUDE.md explains the workflow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

bin/vault-run

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Edit the shared vault safely: lock, back up, decrypt to a private temp file,
+# run your command on it, check the YAML, re-encrypt, and swap it in at once.
+# The command gets the plaintext path as $VAULT_PLAIN (also appended as the
+# last argument). Never use `ansible-vault edit`.
+#   bin/vault-run python3 my_edit.py
+#   bin/vault-run nvim
+set -euo pipefail
+. "$(dirname "$0")/_common.sh"
+[ $# -gt 0 ] || { echo "usage: bin/vault-run <command...>" >&2; exit 2; }
+vault="$main_checkout/group_vars/all/vault.yml"
+pass="$main_checkout/vault_pass"
+av="$main_checkout/.venv/bin/ansible-vault"
+take_lock vault
+backups="$HOME/Documents/backups/ansible-vault"; mkdir -p "$backups"
+cp -p "$vault" "$backups/vault.yml.$(date +%Y%m%d-%H%M%S)"
+tmp=$(mktemp -d "$lock_dir/vault.XXXXXX"); trap 'shred -u "$tmp"/* 2>/dev/null; rm -rf "$tmp"' EXIT
+export VAULT_PLAIN="$tmp/vault.yml"
+"$av" decrypt --vault-password-file "$pass" --output "$VAULT_PLAIN" "$vault" >/dev/null
+"$@" "$VAULT_PLAIN"
+"$main_checkout/.venv/bin/python" -c 'import sys,yaml; yaml.safe_load(open(sys.argv[1]))' "$VAULT_PLAIN"
+"$av" encrypt --vault-password-file "$pass" --output "$tmp/vault.enc" "$VAULT_PLAIN" >/dev/null
+chmod --reference="$vault" "$tmp/vault.enc" 2>/dev/null || true
+mv "$tmp/vault.enc" "$vault"
+echo "vault updated"