Check the deployment files before a user's first boot

Check the deployment files before a user's first boot

The files a new instance is built from are the ones nobody runs before a
user does. A stray placeholder, a boot script with a syntax error, or a
compose file naming a path that is not there all fail minutes after someone
paid for a machine.

check-deploy.py parses every YAML under deploy/, renders the template with
the placeholder list render.sh uses (so the two cannot drift), checks the
rendered document has the files it promises, and runs `sh -n` on the boot
script and the container entrypoint. Terraform is formatted with
`terraform fmt -check`, from a version pinned by checksum for both
architectures a runner can be, beside nfpm and govulncheck.

The link checker also skips .terraform, which every operator will create in
place, and the ignore file keeps Terraform's working directory out of Git
while keeping its lock files in.