PR B: make provisioning master the single source of truth (recreate prod & test deliberately)

**Why**: The 6/17 cutover deployed prod from `feature/prod-green` (never merged); test's full 4.2 config likewise sits on unmerged branches. Result: master cannot describe either machine, and every `--tags config` deploy from master partially rolls back the cutover — the exact mechanism of the 6/26 silent Beat-schedule revert (#37, Gluejar/regluit#1140, fixed by #55). Consensus scope from the 2026-07-01 analysis session (CC + Codex converged; RY approved).

## Goal
After this work: **one command sequence, from provisioning `master`, on a fresh Ubuntu 24.04 box + fresh prod-snapshot RDS → a working unglue.it.** Master recreates reality *deliberately*; every intended environment difference is a named variable; anything else is drift.

## Scope
1. **Master ↔ prod template parity** (beyond #55's settings fix): reconcile every rendered file; acceptance: `setup-prod.yml --check --diff` against prod ≈ no-op (modulo timestamps).
2. **Test config into master**: fold the unmerged 4.2 test provisioning (`feature/prod-green` d45b0cd/354a1e0 lineage) into master with explicit `group_vars/test`.
3. **Deliberate-delta table for test** (each a named group_var, documented): own RDS (never prod — #55's guard enforces), **outbound-email squelch** (`disable_admin_emails` is NOT sufficient; test DB = prod snapshot with real user addresses), Beat schedule empty (`deploy_type`), test cert/DNS, smaller instance.
4. **App-branch mode switch documented**: test defaults to app `git_branch: master` (staging gate for the release queue). Flipping to `git_branch: production` = byte-faithful prod-rehearsal mode; the flip must be intentional, visible, and verified after deploy.
5. **24.04 bootstrap fix**: `setup-prod.yml` still raw-installs python3.8 — dead on Ubuntu 24.04; a from-scratch build fails at task 1.
6. **Kill list** (close/supersede/delete once parity is proven): PRs #25, #38, #39; branches `feature/prod-green`, `feature/maintenance-mode`; app repo branch `test.unglue.it` (stale 1.11-era, 12 ahead/69 behind, inert but a booby trap).
7. **Acceptance gate = #45's criterion, run on TEST first**: tear down test.unglue.it, rebuild entirely from master + explicit test vars, restore fresh prod snapshot, smoke. Zero prod risk; scripts the manual infra steps (EC2/RDS/DNS/cert) as they're performed. Only after this passes does **test-first become standing policy** for config changes.

## Sequencing
#55 (restore Beat decision) → deploy + verify on prod → this issue → test teardown/rebuild proof → test-first policy.

Refs: #45 (from-scratch acceptance criterion), #55, #37, #38, #25, #39, Gluejar/regluit#1140, Gluejar/regluit#1171 (the app-repo precedent this mirrors).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_017f8mDXQDLfw3A34ynseDyc

Start with setup-prod.yml, the existing provisioning files, and the unmerged feature/prod-green lineage; identify the rendered prod files and current group_vars, then compare them with production. Add explicit group_vars/test values, fix the Ubuntu 24.04 bootstrap path, and use #45's from-scratch acceptance criterion on test first. Done means a fresh test rebuild from master passes smoke checks without prod risk and the deliberate differences are documented.

Written by the indexing model from the issue text.