Stop cloning osism/testbed during deployment

[ideaship]

Problem

The testbed deploy flow has a subtle self-defeating step: setup-testbed.py --prepare (triggered by make bootstrap) clones a fresh copy of osism/testbed
from GitHub into <checkout>/.src/github.com/osism/testbed. The
manager-part-1.yml synchronize task then pushes that GitHub clone —
not the developer's working checkout — to /opt/configuration on the manager.

The practical effect: local edits to the testbed checkout never reach the
manager. To test a local change you had to push it to GitHub first.

The Makefile worked around this by overriding basepath and repo_path
in the bootstrap deployment invocation, keeping local runs functional. But
this masked rather than fixed the problem: the override used $(PWD), which
GNU make resolves to the caller's directory, not the testbed checkout, so
make -C /path/to/testbed deploy from a different CWD would break. And it
meant the playbook defaults were wrong for anyone not using the Makefile.

Zuul was unaffected because it never runs --prepare; its basepath
resolved correctly via the old default (Zuul's checkout path matched the
hardcoded convention). So the problem was invisible in CI.

What changed

1. basepath derives from playbook_dir | dirname.

Every playbook used to compute basepath as
{{ ansible_user_dir }}/src/{{ repositories['testbed']['path'] }} — a
hardcoded path that only worked if the checkout lived at
~/src/github.com/osism/testbed. It now uses
{{ playbook_dir | dirname }}, Ansible's built-in variable for the
directory of the executing playbook. dirname strips one level to give
the checkout root.

This is correct for the intended invocation paths: Zuul's checkout, a
local developer's path, or a worktree at an arbitrary location.
playbook_dir resolves to where the playbook actually is. No convention,
symlink, or override needed. The sanity check (Change 4) catches
misconfigured invocations.

The Makefile's -e basepath=... and -e repo_path=... overrides are
removed; playbook_dir | dirname is now the single source of truth.
(deploy.yml's repo_path default is also fixed to derive from basepath
rather than ansible_user_dir, for the same reason.)

2. The testbed: entry is removed from playbooks/vars/repositories.yml.

setup-testbed.py --prepare clones every entry in repositories.yml into
<checkout>/.src/…. After Change 1, nothing reads repositories['testbed']
for its path, so the clone serves no purpose. Removing the entry stops
--prepare from pulling a fresh osism/testbed from GitHub on every run.

The remaining entries (ansible-collection-commons,
ansible-collection-services, terraform-base) are unaffected; they are
still needed for orchestrator-side ansible-galaxy collection install.

3. The synchronize task is replaced with an ephemeral worktree sync.

The old task pushed the contents of
{{ repo_path }}/osism/testbed/ — the stale GitHub clone — to
/opt/configuration on the manager. The replacement:

1. Creates a temporary directory on the orchestrator.
2. Adds an ephemeral detached git worktree at HEAD into that directory
   (git worktree add --detach).
3. Rsyncs the worktree's contents to /opt/configuration (delete: true,
   --exclude=/.git).
4. Removes the worktree in an always: block, even on sync failure.

A git worktree at HEAD materializes only tracked files in the state recorded
at that commit — no working-tree modifications, no untracked files, no
.git/ directory, no build artifacts. The source is always clean, so
delete: true is safe and leaves /opt/configuration in an exact, known
state.

Development iteration goes through git commit (or --amend). The
manager's deployed state corresponds to a specific SHA, which is useful for
correlating manager behaviour with a particular tree version in logs and bug
reports.

4. A fast-fail sanity check is added to all seven playbooks.

A shared task list (playbooks/tasks/_basepath_check.yml) checks that
basepath points to a directory containing ansible/manager-part-1.yml.
Each playbook imports it as a pre_task. A misconfigured basepath now
fails immediately with a clear message instead of silently mis-deploying.

Scope

This change covers only the osism/testbed self-clone. The other repos in
repositories.yml (ansible-collection-*, terraform-base) still follow
the existing path: setup-testbed.py --prepare clones them, and
deploy.yml installs them via ansible-galaxy. They are out of scope here.

Before / after

	Before	After
basepath source	Hardcoded ~/src/github.com/osism/testbed (Makefile override for local)	playbook_dir | dirname (always the invoking checkout)
Testbed content on manager	GitHub main at clone time	Committed state of invoking checkout at deploy time
setup-testbed.py --prepare clones testbed	Yes	No
.src/github.com/osism/testbed created	Yes	No
.git/ in /opt/configuration	No	No
Local edits visible without push	No	Yes (after git commit)
Zuul behaviour	Unchanged	Unchanged

Test plan

End-to-end verified on regiocloud (DEPLOY_MODE=manager, VERSION_MANAGER=latest):

• Sanity check fires for all 7 playbooks when invoked with basepath=/tmp
• setup-testbed.py --prepare no longer creates .src/github.com/osism/testbed
• Run manager part 1 + 2 completed without error
• A test commit visible in /opt/configuration/environments/manager/configuration.yml on manager (confirms worktree sync pushed committed content)
• No .git/ directory on manager (test ! -d /opt/configuration/.git && echo OK)
• No clone.*osism/testbed references in deploy log

🤖 Generated with Claude Code

[ideaship]

ansible-lint check failed due to a transient registry pull failure (registry.osism.tech/osism/ansible-lint:latest could not be fetched after 3 retries), not a lint violation. Re-checking.

[ideaship]

recheck

[berendt]

/lgtm