Fleet-wide change: CI now builds the site in an isolated container and
pushes output via rsync to a forced-command SSH key restricted (via
rrsync) to this site's own docroot only, instead of relying on the
shared Actions runner's blanket /var/www/** bind-mount capability. See
the static-site-deploy Ansible role in reground-infrastructure.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
will