Run the fleet deploy every day at midday

Adds a schedule trigger to deploy-on-merge so deploy.yml also runs daily
at 11:00 UTC (noon London time in BST). It shares the existing concurrency
group, so it queues behind a merge deploy instead of overlapping it.

.github/workflows/deploy-on-merge.yml

@@ -1,4 +1,4 @@
-name: Deploy (on merge)
+name: Deploy (on merge + daily)
 
 on:
   push:
@@ -9,9 +9,14 @@ on:
       - "docs/**"
       - "**/*.md"
       - ".github/**"
+  # Daily fleet deploy at midday to catch drift from anything changed by hand.
+  # Cron is UTC: 11:00 UTC is 12:00 in London during BST, 11:00 during GMT.
+  schedule:
+    - cron: "0 11 * * *"
 
-# Serialize fleet deploys so two quick merges can't run Ansible against the
+# Serialize fleet deploys so two quick merges (or a merge and the daily run)
-# same hosts at once. Don't cancel an in-flight deploy mid-run — queue it.
+# can't run Ansible against the same hosts at once. Don't cancel an in-flight
+# deploy mid-run — queue it.
 concurrency:
   group: deploy-on-merge
   cancel-in-progress: false

ansible/README.md

@@ -20,6 +20,15 @@ make deploy
 make deploy-host HOST=helsinki-a
 ```
 
+## CI deploys
+
+`.github/workflows/deploy-on-merge.yml` runs `deploy.yml` over the whole fleet:
+
+- on every merge to `main` (except terraform/docs/workflow-only changes)
+- every day at 11:00 UTC (midday London time during BST), to pull hosts back in line with the repo
+
+Ad-hoc runs against a single host or playbook go through the manual `deploy.yml` workflow.
+
 ## Playbooks
 
 | Playbook | Purpose | Usage |