Fix deploy/rollback to clean code dir before extract

Overlay-only extract left files added by the newer version behind
after a rollback (2026-10-26: after rolling back ops-batch,
deploy/ new scripts were still present). Before every extract,
delete app-dir contents except work/ (task worktrees), then
extract; backup tarballs also exclude work/, so worktrees are
preserved on both deploy and rollback.

deploy/rollback.sh

@@ -67,6 +67,7 @@ if [ -z "$BACKUP_FILE" ]; then
 fi
 echo "将恢复备份包：$BACKUP_FILE"
 systemctl stop codex-cloud-worker codex-cloud-server || true
+find "$APP_DIR" -mindepth 1 -maxdepth 1 ! -name work -exec rm -rf {} +
 tar -xzf "$BACKUP_FILE" -C /opt
 chown -R codexsvc:codexsvc "$APP_DIR"
 systemctl start codex-cloud-server codex-cloud-worker