deploy: fix host backup tar exclude patterns

The host backup tar runs with -C /opt codex-app-server, so its
members are named codex-app-server/..., and the old patterns
./work and ./worker-heartbeat.json never matched anything.
The live work/ dir (host-state, worktrees rewritten by running
workers) was therefore included, tar hit 'file changed as we
read it', exited 1, and set -e aborted the deploy. Patterns
are now codex-app-server/work and
codex-app-server/worker-heartbeat.json, which actually match.

deploy/deploy.sh

@@ -125,7 +125,7 @@ wait_health() {
 }
 
 # 1. 备份当前代码（排除 work/，只留最近 3 份）
-tar --exclude='./work' --exclude='./worker-heartbeat.json' -czf "$BACKUP_FILE" -C /opt codex-app-server
+tar --exclude='codex-app-server/work' --exclude='codex-app-server/worker-heartbeat.json' -czf "$BACKUP_FILE" -C /opt codex-app-server
 echo "已备份当前代码到：$BACKUP_FILE"
 ls -t "$BACKUP_DIR"/codex-app-server-*.tar.gz 2>/dev/null \
   | tail -n +4 | xargs -r rm -f