Removes the deploy_cidrs variable from infra/sidecar, so port 22 stays open only to Lightsail's browser console. The sidecar's scripts/deploy.sh (tangled-collaborator-sidecar#4) now adds the deploying machine's address to port 22 for the length of a deploy, and restores the exact rules after. A tofu plan run during a deploy shows that extra address, and the comment says so. docs/sidecar.md drops the apply-with-your-address step.
🤖 Generated with Claude Code