We have a working howto now, so this is fixed. More issues crept up,
but I'll document them too.

See: team#40755

This reverts commit 14d81c9d.

It's redundant, more noisy, and less precise than dsa-check-packages.

It was also purged from all hosts with cumin.

The rationale here is that we prefer to outsource the technical and
staff risks to outside, because TPA is already pretty loaded.

The problem, now, of course, is that we need to make a NEW RFC, but
one thing at a time.

For details, see tpa-team email with Message-ID:
CAAA5PKyJBWX82MYmXPX-Uq8+U00tO8DDFDA0yoGjYAOOX8qTVw@mail.gmail.com

According for my tests, if commits are added to an existing branch, then
the new commits are created using LFS as expected.

Some roles now have extra merge permissions on the blog and main website.

I tested this by locking `aguestuser`'s account (tpo/tpa/team#40772),
and running ud-generate on alberti. The user was still present on
alberti in: `/var/cache/userdir-ldap/hosts/forward-alias`.