Two nodes on exch and one on infra-gamma, plain Compose per server, ports
on the private addresses only. Nodes unseal through the transit seal on the
platform Vault; the transit token reaches only the server process.
make prod-images resolves the latest stable Vault release once and pins its
digest in ignored .local/prod/images.env, so every node runs the same build.
infra/prod/README.md records the layout, the first rollout, node
replacement and recovery when the platform Vault is lost (#74).
protuberanets