Deploys from unpushed branches were being reverted by the next deploy
from main, and in-place vault edits could overwrite each other.
- deploy-guard.yml (imported by site.yml and dns.yml) refuses real runs
unless the checkout is clean and exactly origin/main; --check is fine.
- bin/deploy holds a lock so only one deploy runs at a time.
- bin/vault-run edits the vault under a lock with an atomic swap.
- bin/worktree starts a task in a fresh worktree from origin/main.
- CLAUDE.md explains the workflow.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
