Run the production Vault as three raft nodes on exch and infra-gamma

Two nodes on exch and one on infra-gamma, plain Compose per server, ports
on the private addresses only. Nodes unseal through the transit seal on the
platform Vault; the transit token reaches only the server process.

make prod-images resolves the latest stable Vault release once and pins its
digest in ignored .local/prod/images.env, so every node runs the same build.

infra/prod/README.md records the layout, the first rollout, node
replacement and recovery when the platform Vault is lost (#74).

infra/local/scripts/images.sh

@@ -22,3 +22,10 @@ images() (
  cat "$WORK/images.env" | write "$STATE/images.env"
  cat "$STATE/images.env"
 )
+# Production pins: one resolution for every node of a cluster, so all of them
+# run the same build. Written outside .local/dev; copied to the servers.
+prod_images() (
+ ref=$(image hashicorp/vault latest) || exit 1
+ printf 'VAULT_IMAGE=%s\n' "$ref" | write "$PWD/.local/prod/images.env"
+ cat "$PWD/.local/prod/images.env"
+)