Deploy the hotcell cell from the kamal hooks, not bin/deploy

[flavorjones]

bin/deploy (#3102) wrapped bin/kamal deploy to bring the cell along, which left kamal deploy, kamal rollback, --hosts and --roles as the paths that did not. The pre-deploy hook already ran saas/hotcell/bin/check on every one of them; it only lacked the fix. Same change as basecamp/haystack#8781.

saas/hotcell/bin/check does the work. Bare, it is unchanged: report and exit 2 (build and push), 3 (reboot), or 1 (could not tell). New flags:

• --publish: if the registry lacks the pinned image, build it --platform=linux/amd64, refuse if the build moved the pin, push, and check the registry again. Never sshes.
• --reboot: if a host is off the pin, bin/kamal accessory reboot hotcell --skip-hooks, then ask again. A fix that did not take prints the full explanation.
• --apply: both.
• --version=SHA: take the pin from git show SHA:saas/config/deploy.yml instead of the working tree. A version that is not a commit (kamal's <sha>_uncommitted_<hex>) falls back to the tree; an unfetched sha warns and falls back.
• --hosts=a,b: ask, and reboot, those hosts only. A list naming every cell host behaves as no list: sample one, reboot all.

The accessory's hosts still come from Kamal::Configuration, as before, since the saas config lives in the gem.

The hooks stay small. A new saas/.kamal/hooks/pre-build runs check --version=$KAMAL_VERSION --publish before the deploy lock and with no ssh. pre-deploy runs check --version=$KAMAL_VERSION --hosts=$KAMAL_HOSTS --reboot under the lock. So:

• kamal deploy publishes a new cell image after the app image and reboots the cell before the app boots.
• kamal rollback SHA runs pre-deploy with KAMAL_VERSION=SHA, so the cell goes back to what that commit pinned. Rollback runs no pre-build; a rolled-back image is already in the registry.
• --hosts/--roles reach the hook as an already-filtered KAMAL_HOSTS, and kamal accessory reboot intersects them with the accessory's hosts itself.
• The nested kamal runs under the lock the hook holds: run_hook exports KAMAL_LOCK=true and Kamal::Commander reads it back.

The hooks' output is visible. Kamal runs a hook through SSHKit, which logs its stdout at DEBUG, so at the default verbosity the build, push, and reboot leave only Running/Finished lines behind. hooks_output: verbose for both hooks in saas/config/deploy.yml shows them. That setting is kamal 2.12's, so kamal moves 2.11 → 2.12 in both lockfiles.

SKIP_HOTCELL_CHECKS=1 still skips all of it. bin/deploy, saas/bin/deploy and saas/test/deploy-test are gone; saas/test/hotcell-check-test (33 assertions) drives the real check and both hooks against stubbed docker, ssh, bundle, bin/kamal, build and push. SAAS=1 bin/kamal config -d staging renders under 2.12; nothing has run against a live destination.

ref: https://app.basecamp.com/2914079/buckets/1666/card_tables/cards/10265014345

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.