Add a code deploy tag and restart on version mismatch

[kilo666mj]

Why

• There was no way to run just the upgrade part of the playbook.
• The v0.6.0 rollout exposed a gap: the first run failed on a missing variable after Install sshgate binary had copied the new binary and notified Restart sshgate. Ansible drops pending handlers when a play fails. The rerun built a byte-identical binary, so the copy task was ok, nothing notified the handler, and every host kept running the old process (mx: v0.6.0 on disk, v0.5.0-2-g5ad8110 running since Sep 14). The existing verify step only checked that sshgate_build_info existed, so it passed.

What

• --tags code: describe, build, install binary, restart (graceful reload when running), reconnect, verify.
• New Check which sshgate version is running task compares the running sshgate_build_info version with the one just built and notifies Restart sshgate when they differ (or the endpoint is unreachable). Runs in full and code runs.
• The final verify step now polls (15 × 2s) until the running process reports the deployed version, instead of accepting any version.
• Version, metrics URL and expected build_info are play vars shared by the build, check and verify tasks.
• docs/deployment.md: documents --tags code and the mismatch restart.

Testing

• ansible-playbook --syntax-check passes; --list-tasks --tags code lists the 8 intended tasks.
• Ran the mismatch check alone against mx (no deploy): expecting v0.6.0 → changed (restart queued), expecting the running v0.5.0-2-g5ad8110 → ok, unreachable endpoint → changed.
• Not yet run as a real deploy.

🤖 Generated with Claude Code