Drop internal cluster and ops-repo names from the staging runner comment

[aterga]

Summary

The last infrastructure detail left in the tree. deploy.yml's ship_runs_on comment named the two specific clusters the dind-small pool runs on, its runner group, and the internal ops repository — none of which is needed to explain why the input is a bare scale-set name rather than a label list, which is the comment's actual job.

Flagged in pre-publication diligence alongside the issue/PR bodies. This is the tree half; the issue and PR bodies are being handled separately.

Related issues

#101. Completes the tree-side scrub started in #102 and #104.

Changes

• deploy.yml: replaced the cluster/group/ops-repo naming with a generic description.

Kept the parts that carry information:

• Why a label list matches nothing (ARC scale sets carry no default labels) — this is the mistake that left a deploy queued indefinitely, so it earns its place.
• That the pool's pods reach the host over the VPN, confirmed by a deploy that passed the /version assertion.
• That the pool spans more than one cluster and a pod can land on either, so the source address the host sees is not fixed. This is the load-bearing reason the port-22 rule can't be narrowed on a single observation (Narrow inbound SSH to the private range and delete the world-facing rule #91), and it survives without naming the sites.

Added a pointer to DEPLOY_HOST's description, since none of this holds if that names the public FQDN rather than the private address — staging was set that way, and its deploys were silently leaving over the internet.

Testing

• deploy.yml parses; ship_runs_on still resolves to "dind-small".
• git grep for the cluster names, runner group and ops-repo across the tree returns nothing, excluding base64 false positives inside the compiled asset bundle (src/assets/index.html, where those strings occur inside encoded image data).
• Combined with Stop documenting a decommissioned host address as the DEPLOY_HOST example #102 and Rewrite the inbound-SSH section: it described a state that no longer exists #104, the tree now has no internal IPs, VPC/subnet/security-group/ENI/instance identifiers, internal IPv6 addresses, site codes or internal repo names.
• Not run: cargo / npm — comment-only change.

Checklist

• I have read the Contributing guidelines.
• Docs (README / comments) updated for any user-visible change — this PR is the comment change.
• No secrets, credentials, or internal-only information are included — it removes internal names rather than adding any.

---

Generated by Claude Code

[Copilot]

Pull request overview

Removes internal infrastructure identifiers from the staging deploy workflow’s ship_runs_on explanatory comment, while preserving the operational rationale for using a bare ARC scale-set name and for requiring DEPLOY_HOST to be privately reachable.

Changes:

• Replaces the ship_runs_on comment text to omit specific cluster names, runner group, and internal ops repo references.
• Keeps the key behavioral explanations: ARC scale sets lacking default labels, VPN/private reachability, and non-fixed source address due to multi-cluster scheduling.
• Adds an explicit pointer that DEPLOY_HOST must be the host’s private address (with a reference to the secret’s description in deploy-native.yml).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.