Give Bento a per-host repo path
Namespace release tags per app, and refuse a dirty tree before a release
Add a Bento service kind that deploys onto the host that runs it