Add guard rails for several agents working on the repo at once

Deploys from unpushed branches were being reverted by the next deploy
from main, and in-place vault edits could overwrite each other.

- deploy-guard.yml (imported by site.yml and dns.yml) refuses real runs
  unless the checkout is clean and exactly origin/main; --check is fine.
- bin/deploy holds a lock so only one deploy runs at a time.
- bin/vault-run edits the vault under a lock with an atomic swap.
- bin/worktree starts a task in a fresh worktree from origin/main.
- CLAUDE.md explains the workflow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

bin/worktree

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Start work on a fresh branch in its own worktree, based on the latest main.
+#   bin/worktree <branch-name>
+set -euo pipefail
+. "$(dirname "$0")/_common.sh"
+name=${1:?usage: bin/worktree <branch-name>}
+dest="$(dirname "$main_checkout")/ansible-worktrees/$name"
+git -C "$main_checkout" fetch -q origin
+git -C "$main_checkout" worktree add -b "$name" "$dest" origin/main
+cd "$dest" && repo=$dest && link_vault
+echo "Ready: $dest"