Piloting a fleet-wide change: CI now builds the site in an isolated
container and pushes output via rsync to a forced-command SSH key
restricted (via rrsync) to this site's own docroot only, instead of
relying on the shared Actions runner's blanket /var/www/** bind-mount
capability. See the static-site-deploy Ansible role.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
will