fix(deploy): stop the dedicated deploy from git-cleaning its own checkout

`MODE_CLEANUP` says what to tidy on the deployed system: prune unused Docker
resources, clear Mastodon caches, switch an LDAP user list from `present` to
`exact`. Eight roles read it that way. The dedicated runner read the same flag
and ran `make clean` in the control repository instead, which is
`git clean -fdX` over every ignored path there.

`inventories/production/` is one of those paths. The published host install
guide provisions into it and then deploys against `$INVENTORY/.password`, so
the deploy deleted the vault password it was about to use:

    Removing inventories/production/
    [ERROR] The vault password file .../inventories/production/.password was
    not found

Reproduced in CI on two unrelated rows, arm64/zfs/debian and
amd64/btrfs/centos, so it is neither architecture nor filesystem specific.

The coupling was a name collision, not a decision. 7e5990aa16 generated the
MODE_* flags from `01_modes.yml` and removed the legacy skip flags, and the
repository clean - which had had a flag of its own - was attached to the
generated `MODE_CLEANUP` because one now existed by that name. No other deploy
path does this; `container`, `development` and `swarm` never call `make` at
all.

`make clean` keeps its own entry points, `make setup-clean`, `make clean-sudo`
and `infinito --git-clean`, where a caller asks for it deliberately.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/python/cli/administration/deploy/dedicated/test_runner.py

@@ -89,7 +89,11 @@ class TestRunAnsiblePlaybook(unittest.TestCase):
         def was_called(cmd: list[str]) -> bool:
             return any(call_cmd == cmd for call_cmd, _kw in calls)
 
-        self.assertTrue(was_called(["make", "clean"]), "Expected 'make clean'")
+        self.assertFalse(
+            was_called(["make", "clean"]),
+            "MODE_CLEANUP tidies the deployed system, so it must not git-clean "
+            "the control checkout and delete the inventory being deployed",
+        )
         self.assertTrue(was_called(["make", "setup"]), "Expected 'make setup'")
 
         for call_cmd, kw in calls: