feat(deploy): support positional release inputs

www/integrations/nixos/deploy.md

@@ -7,11 +7,14 @@ It does not run `nixos-rebuild`, reload nginx, change DNS, or write directly to
 ## Required local tools and private inputs
 
 - Node.js 22+, Git, tar, SSH and rsync.
-- A normal SSH identity accepted by the existing root receiver:
-  `AIA_DEPLOY_SSH_IDENTITY=/absolute/path/to/identity`.
-- `AIA_DEPLOY_HOST=administrator@host` (or the approved equivalent).
-- For a real public release, an owner-controlled, regular encrypted payload:
+- Either an OpenSSH host alias already configured locally, or a normal SSH
+  identity accepted by the existing root receiver.
+- For environment-only invocations: `AIA_DEPLOY_HOST=administrator@host`,
+  `AIA_DEPLOY_SSH_IDENTITY=/absolute/path/to/identity`, and
   `AIA_PORTAL_PRODUCTION_CIPHERTEXT_FILE=/absolute/private/employee-portal/approved-production-ciphertext.json`.
+- For positional invocations, use either `SSH_HOST CIPHERTEXT` (OpenSSH resolves
+  the host alias and identity) or `SSH_HOST SSH_IDENTITY CIPHERTEXT` (the CLI
+  supplies `-i` and `IdentitiesOnly=yes`).
 
 The payload remains outside Git and the source snapshot. It is browser ciphertext
 only; neither access code nor decrypted portal HTML enters an Astro environment
@@ -23,6 +26,15 @@ From `www/`:
 
 ```sh
 npm run deploy -- --dry-run
+
+# Use a configured OpenSSH host alias and a private ciphertext path.
+npm run deploy -- --dry-run aiar \
+  "$PWD/private/employee-portal/approved-production-ciphertext.json"
+
+# Supply an explicit SSH identity; paths may contain spaces.
+npm run deploy -- --dry-run 'root@66.94.121.180' \
+  "$HOME/.ssh/AIAMarketing" \
+  "$PWD/private/employee-portal/approved-production-ciphertext.json"
 ```
 
 Dry-run performs the local production build, tests, artifact verification,
@@ -37,8 +49,27 @@ AIA_PORTAL_PRODUCTION_CIPHERTEXT_FILE="$PWD/private/employee-portal/approved-pro
 npm run deploy -- --confirm
 ```
 
+The equivalent confirmed positional commands are:
+
+```sh
+npm run deploy -- --confirm aiar \
+  "$PWD/private/employee-portal/approved-production-ciphertext.json"
+
+npm run deploy -- --confirm 'root@66.94.121.180' \
+  "$HOME/.ssh/AIAMarketing" \
+  "$PWD/private/employee-portal/approved-production-ciphertext.json"
+```
+
+When positional values are present, they take precedence over all three
+deployment environment variables. Two positional values deliberately omit
+`-i`, allowing the local OpenSSH configuration to select the identity. Dry-run
+never opens SSH or rsync, even when host and identity arguments are provided.
+Invalid modes, mixed confirmation flags, incomplete positional sets, unsafe
+hosts, relative positional paths, and missing ciphertext files fail before a
+release can be promoted.
+
 The confirmed command builds with `PUBLIC_ALLOW_INDEXING=true`, Form A live and
-counters off, then uploads only fresh commit-specific `staging/source-<sha>` and
+the approved live counters configuration, then uploads only fresh commit-specific `staging/source-<sha>` and
 `staging/dist-<sha>` directories. It runs, in order:
 
 ```text