Google Container Registry

Putting the deploy command next to the app leaves CI one verb to call

An Nx deploy target holds the whole build, push and deploy line, so CI only calls it and cannot keep a drifting copy. The tradeoff is a production shell string that nothing validates and a public-access flag one diff away.