[wip] script/deploy

Hide the `ansible-playbook` commandline behind a `script/deploy` entry point.

This will save a lot of copying and pasting from the README. It'll also let us:

- Catch common errors and missing dependencies before they blow up in a weirder way, and fail with a nicer message.
- Update the command line without disrupting anyone's learned workflow. For example, #384 will add a `-M` argument, and #383 will add `--ask-vault-pass`; if I can just add them to `script/deploy` instead of amending the README, I won't break everyone's mojo when those get merged.