Delivery pipeline

We don't want to SSH and copy-paste forever. Push to main, let a robot check it, then update the box.

CI says "it still boots." CD says "and now the server has it."