Specify exactly how and where Ansible runs (bootstrap, production crontask, development)

This should help illustrate my mailing-list conversation wondering exactly how we should accomplish this.

Because this won't work well in development (it will always look at
prod-hosts), it's easily disabled with no_ansible_pull=true in the
inventory.  Fixes #3089.
People would not be logged into the service account very often, right? `sh` on FreeBSD 10.0 or 10.1 supports tab completion, solving I feel the most important issue. Using `csh` is a non-starter and I don't like using something from ports just in case.