Deduplicate release-ref resolution logic in ansible/deploy.yml

[ineedjet]

Problem

ansible/deploy.yml has three near-identical ~30-line bash blocks, each
parsing an owner/repo@tag[:asset] ref, resolving @latest via
gh release view, and downloading the asset:

• "Pull Flightdeck package" (machinery bundle, flightdeck_app_ref, single ref)
• the download_release_ref() function inside "Pull and merge app packages"
  (called once per entry in flightdeck_app_refs)
• "Pull encrypted env package" (flightdeck_env_ref, single ref)

These three copies implement the exact same parsing/resolution logic
independently, and #102 added a fourth-ish variant (the loop version) while
splitting flightdeck_extra_refs into flightdeck_app_refs. A bug fix or
behavior change to ref resolution (@latest handling, :asset-name suffix
parsing, error messages) needs to be applied in three places by hand, with
nothing — no test, no lint — catching a missed spot.

Proposed change

Prefer Ansible-native reuse instead of extracting this into a standalone
shell-script dependency. Move the shared release-ref download/resolution
sequence into a reusable task file, for example:

ansible/tasks/download_release_asset.yml

and invoke it from the existing call sites with ansible.builtin.include_tasks,
passing the ref, output directory, and default-asset behavior as variables.

The reusable task should expose enough facts/results for callers to use the
resolved artifact, ideally including:

• original ref;
• repository;
• resolved tag (especially when the input uses @latest);
• resolved asset name;
• downloaded file path.

This keeps the orchestration expressed as Ansible tasks while centralizing the
ref parsing, @latest resolution, download, validation, and error behavior.

Env asset detail

The env call site has one important difference from the machinery/app bundle
cases: when no explicit :asset suffix is supplied, its default asset name is
derived from the resolved tag (<tag>.sops.env). Therefore owner/repo@latest
must first resolve latest to the concrete release tag and only then derive
the default env asset name.

The reusable task should support this without duplicating ref-resolution logic
back into the env caller.

This structure should also compose naturally with future env_refs: the caller
can loop over refs and include the same reusable task for every source rather
than introducing another copy of the shell implementation.

Not urgent — the current duplication works correctly (--syntax-check and
matrix trace-through verified in #102) — but worth doing before additional
call sites appear or this logic needs an actual bug fix.

Related

Surfaced during final review of #102. Also relevant to #104 (env_refs).

[ineedjet]

Resolved via #111/#115 — more thoroughly than proposed here. Instead of Ansible-native reuse (include_tasks), ansible/deploy.yml was removed entirely and replaced with deploy/deploy.py; ref-resolution now lives in exactly one place (deploy/resolve.py), with real unit tests instead of --syntax-check + manual matrix tracing. The three-way duplication this issue described no longer exists in any form.