[ralyodio]

Why

Managing a different permanent SSH private key in every application repository does not scale. This proposal standardizes GitHub Actions deployment for all Profullstack sites without sharing a permanent private deployment key across them.

What's implemented

• Shared reusable GitHub Actions deploy workflow, called after each repo's tests/type checks/ThreatCrush scan; supports main and master.
• GitHub OIDC -> self-hosted OpenBao JWT auth -> five-minute signed SSH certificate, with no per-app SSH secrets.
• Stable repository-ID-based central inventory, centrally configured signer URL and verified SSH host keys. Record the operator-supplied partial domain list without guessing GitHub repo/server mappings.
• OpenBao enrollment script that generates repository-scoped JWT auth, ACL and SSH signing roles (no manual per-app key rotation).
• Per-repo unprivileged SSH login principal, forced-command deployment receiver verifying enrolled Git remote and SHA on protected branch, reusing deploy-gate.
• Fail-closed enrollment/URL/host/CI/SSH checks and unit tests; detailed setup/rotation/migration guide.

Deliberate safety gate

The pilot PIT mapping is enabled: false; OpenBao, the central CA, host keys, and an unprivileged PIT checkout do not exist yet as verified facts. This PR does not touch any production server or replace PIT's existing workflow. Infrastructure provisioning + a separate pilot PR are required before changing live deployment auth. Repo-specific deployment permissions are generated from central registry, not separate private keys.

See docs/fleet-ssh-ca.md and fleet/targets.json. CI must pass before merge.