Run the production Vault as three raft nodes on exch and infra-gamma

Two nodes on exch and one on infra-gamma, plain Compose per server, ports
on the private addresses only. Nodes unseal through the transit seal on the
platform Vault; the transit token reaches only the server process.

make prod-images resolves the latest stable Vault release once and pins its
digest in ignored .local/prod/images.env, so every node runs the same build.

infra/prod/README.md records the layout, the first rollout, node
replacement and recovery when the platform Vault is lost (#74).

infra/prod/vault/exch.yml

@@ -0,0 +1,59 @@
+# SXCHNGE production Vault on exch: nodes 1 and 2 of three (#74). Node 3 runs
+# on infra-gamma (gamma.yml). Ports are published on the private address only.
+name: sxchnge-vault
+
+x-vault: &vault
+  image: ${VAULT_IMAGE:?Run make prod-images and copy images.env}
+  restart: unless-stopped
+  cap_add: [IPC_LOCK]
+  ulimits: {memlock: {soft: -1, hard: -1}}
+  environment:
+    VAULT_ADDR: http://127.0.0.1:8200
+    SKIP_SETCAP: 'true'
+  entrypoint: [/bin/sh, /etc/vault/start.sh]
+  secrets: [transit-token]
+  healthcheck:
+    test: [CMD-SHELL, 'vault status >/dev/null']
+    interval: 10s
+    timeout: 5s
+    retries: 6
+
+services:
+  vault-1:
+    <<: *vault
+    ports:
+      - 192.168.10.191:8200:8200
+      - 192.168.10.191:8201:8201
+    volumes:
+      - vault-1-data:/vault/file
+      - ./config/vault-1.hcl:/vault/config/vault.hcl:ro
+      - ./start.sh:/etc/vault/start.sh:ro
+    networks:
+      sxchnge:
+        aliases: [vault]
+
+  vault-2:
+    <<: *vault
+    ports:
+      - 192.168.10.191:8210:8200
+      - 192.168.10.191:8211:8201
+    volumes:
+      - vault-2-data:/vault/file
+      - ./config/vault-2.hcl:/vault/config/vault.hcl:ro
+      - ./start.sh:/etc/vault/start.sh:ro
+    networks:
+      sxchnge:
+        aliases: [vault]
+
+secrets:
+  transit-token:
+    file: ./secrets/transit-token
+
+volumes:
+  vault-1-data:
+  vault-2-data:
+
+# Applications on exch join this network and use http://vault:8200.
+networks:
+  sxchnge:
+    name: sxchnge