Fix deploy/rollback to clean code dir before extract

Overlay-only extract left files added by the newer version behind
after a rollback (2026-10-26: after rolling back ops-batch,
deploy/ new scripts were still present). Before every extract,
delete app-dir contents except work/ (task worktrees), then
extract; backup tarballs also exclude work/, so worktrees are
preserved on both deploy and rollback.

deploy/deploy.sh

@@ -130,7 +130,10 @@ echo "已备份当前代码到：$BACKUP_FILE"
 ls -t "$BACKUP_DIR"/codex-app-server-*.tar.gz 2>/dev/null \
   | tail -n +4 | xargs -r rm -f
 
-# 2. 解包新代码并改属主
+# 2. 先清掉旧代码（保留 work/ 工作区，里面是任务 worktree），再解包新代码。
+# 只做覆盖式解包会留下新版新增的文件，回滚时旧版文件还在，造成“回滚不干净”
+# （2026-10-26 实测：回滚后 deploy/ 新脚本仍残留）。
+find "$APP_DIR" -mindepth 1 -maxdepth 1 ! -name work -exec rm -rf {} +
 tar -xzf /tmp/codex-app-server-code.tar.gz -C "$APP_DIR"
 chown -R codexsvc:codexsvc "$APP_DIR"
 
@@ -144,6 +147,7 @@ fi
 # 4. 失败：恢复备份并重启，再验一次
 echo "新代码 health 未通过，开始回滚到备份：$BACKUP_FILE"
 systemctl stop codex-cloud-worker codex-cloud-server || true
+find "$APP_DIR" -mindepth 1 -maxdepth 1 ! -name work -exec rm -rf {} +
 tar -xzf "$BACKUP_FILE" -C /opt
 chown -R codexsvc:codexsvc "$APP_DIR"
 systemctl start codex-cloud-server codex-cloud-worker

deploy/rollback.sh

@@ -67,6 +67,7 @@ if [ -z "$BACKUP_FILE" ]; then
 fi
 echo "将恢复备份包：$BACKUP_FILE"
 systemctl stop codex-cloud-worker codex-cloud-server || true
+find "$APP_DIR" -mindepth 1 -maxdepth 1 ! -name work -exec rm -rf {} +
 tar -xzf "$BACKUP_FILE" -C /opt
 chown -R codexsvc:codexsvc "$APP_DIR"
 systemctl start codex-cloud-server codex-cloud-worker