chore(devops): arm64 AMIs, bestool alertd and Munin on Tupaia servers

[passcod]

Issue #:

None yet.

Changes:

• Deployment Lambda moves out: it now lives in beyondessential/ops (pulumi/tupaia/infra/lambda, in the tupaia-infra stack), because one Lambda serves every deployment.
• New deployment-aws/startup.sh: what a new server does once the Lambda's boot script has checked out its branch: prompt, preaggregation, Tailscale, build, pm2, nginx and observability. It's versioned with the branch. Branches without it fall back to the old steps.
• Tailscale identity carries over on redeploy:
  • flushToS3.sh --final uploads the node's state and rejoins as an ephemeral <name>-retiring node. It never runs tailscale logout, which would invalidate the uploaded identity.
  • connectTailscale.sh restores that state only when the Lambda tagged the new instance TailscaleIdentity=handed-over, which it does only after a successful handover. The deployment then keeps the same node: same name, address and Canopy binding.
  • Otherwise, or if the restore fails, it starts clean as a new node, as before.
• setup.sh:
  • targets Ubuntu 26.04 on our minimal BES AMIs;
  • drops libappindicator3-1 and uses libgcc-s1;
  • adds cloud-utils and the AWS CLI;
  • bakes in bestool and Munin.
• setupObservability.sh:
  • restores Munin history;
  • installs the S3 flush (hourly, at shutdown, and on request from the Lambda);
  • serves Munin on the tailnet;
  • imports the Canopy registration and starts alertd where one exists.
• flushToS3.sh:
  • uploads Munin history and logs;
  • after the final flush, uploads logs only, so it can't overwrite the replacement's Munin.
• Removed: the Lambda code and setupGoldMaster.sh, both now in the ops stack.
• Docs: the devops README and script comments point at the ops stack.

Related: beyondessential/ops#332, beyondessential/bestool#954, beyondessential/tailscale#39.

Still to do or verify:

• Apply the ops stack. It updates the Lambda, creates the retiring key and the per-deployment roles.
• Smoke-test PDF export on a t4g; puppeteer's Chrome on linux-arm64 is unverified.
• Smoke-test on the 26.04 base:
  • a fresh deploy;
  • a redeploy, checking the node keeps its name and address and the old box shows up as -retiring;
  • a teardown, checking the node disappears.

---

Screenshots:

N/A

---

🦸 Review Hero

• Run Review Hero
• Auto-fix review suggestions
• Auto-fix CI failures
• Save suppressions

🤖 Generated with Claude Code

https://claude.ai/code/session_01Tzq5SfWsJpLpoBxsSG6MVg

[passcod]

The build check (CD Package Android) failed on 3b69212, but not because of this PR. Its "Fetch environment variables" step got a 503 Service Unavailable from Bitwarden Secrets Manager while authenticating. This PR changes neither the Android app nor that workflow. I've re-run the failed job once, and there is no fix to bring in.

---

Generated by Claude Code