[refactor] Isolate Popen, no recursive ansible

Recursive ansible was causing all kinds of problems, especially with IO. Instead, we use ssh to launch a second round of ansible.

Instead of duplicating the popen handling, we then move it to a new function.