Create deploy skill

Summary

Generalize the deploy-qa skill into a broader deploy skill covering the mini-PaaS system.

Source Material

From Omni/Deploy/README.md:

• Pull-based deployment via S3 manifest
• push.sh for deploying services
• deploy-manifest for managing manifest
• Secrets management
• Troubleshooting

Skill Content

---
name: deploy
description: Deploy services using the mini-PaaS system. Use when deploying, checking deployment status, or troubleshooting deployments.
---

# Deploy

The omnirepo uses a pull-based deployment system via S3 manifest.

## Deploying a Service

\`\`\`bash
# Build, cache, and update manifest
Omni/Ide/push.sh Biz/PodcastItLater/Web.py

# Or for Ava specifically
Omni/Ide/ship.sh Omni/Ava.hs
\`\`\`

The deployer on target hosts polls every 5 minutes and applies changes.

## Checking Status

\`\`\`bash
# View current manifest
deploy-manifest show

# Check specific service
deploy-manifest show | jq '.services[] | select(.name == "ava")'

# Check deployer on target
ssh biz sudo systemctl status deployer
ssh biz cat /var/lib/deployer/state.json
\`\`\`

## Troubleshooting

### Service not starting
\`\`\`bash
ssh biz sudo journalctl -u <service-name> -f
\`\`\`

### Deployer issues
\`\`\`bash
ssh biz sudo journalctl -u deployer -f
\`\`\`

### Force immediate deploy
\`\`\`bash
ssh biz sudo systemctl start deployer
\`\`\`

## Rollback

\`\`\`bash
# List available versions
deploy-manifest list

# Rollback to previous
deploy-manifest rollback manifest-YYYYMMDD.json
\`\`\`

## Secrets

Secrets are stored on target hosts, never in S3:
- Location: `/var/lib/deployer-secrets/<service>.env`
- Format: Standard env file
- Permissions: 600, owned by root

## Adding New Service

1. Add service to manifest with `deploy-manifest add-service`
2. Create secrets file on target host
3. Deploy with `push.sh`

Deliverables

• [ ] Omni/Deploy/Skill.md
• [ ] Deprecate/remove deploy-qa skill (too specific)
• [ ] Test with actual deployment