Closes the one manual step left in the pipeline. gw-04 has run
clawmates-deploy.timer every minute since July, pulling :latest and rolling on
drift — the CD half already worked. What was missing was anything that moved
:latest, since the old build host (tank) is packed for the move.
The runner lives on gw-04 because it is the only reachable x86_64 host and prod
images must be linux/amd64: web-01 is aarch64 and the fleet build boxes are
offline. Host executor, capacity 1, so builds serialize rather than competing
with production traffic.
Three details that are not obvious:
- `docker push :latest` does NOT move the tag on this registry once the manifest
exists under another tag. The PUT-the-manifest step is what actually moves it,
and its absence is how a "successful" deploy could leave prod on a stale image.
- The final step verifies the image prod is RUNNING, not the one we pushed. A
green edge on the old image is the failure this pipeline exists to prevent.
- broker is built here too. It had no :latest tag at all, so gw-04's deploy loop
logged a pull failure every single cycle since 2026-08-11.
Also ignore the local env backups: `.env` was ignored but `.env.bak.*` was not,
and those copies hold real credentials.
Co-Authored-By: Claude Opus 5 <[email protected]>
