[WIP] Run ansible in a crontask on service hosts

This should help illustrate my mailing-list conversation wondering exactly how we should accomplish this.

Because this won't work well in development (it will always look at
prod-hosts), it's easily disabled with no_ansible_pull=true in the
inventory.  Fixes #3089.
So you propose not to use service account's home directory?

In any case, this directory is a good candidate to be in `vars`.