修正CEO报销财务兜底与部署护栏（07-28-ceo-finance-fallback）

deploy/trialrun/deploy.sh

@@ -22,6 +22,7 @@ RUNTIME_SMOKE_SCRIPT="server/src/scripts/smoke-trialrun-runtime.js"
 EXTERNAL_DEPS_SMOKE_SCRIPT="server/src/scripts/smoke-external-deps.js"
 PROVENANCE_SCRIPT="deploy/trialrun/check-source-provenance.mjs"
 STAGING_DIR=""
+RSYNC_PROTECT_ARGS=()
 
 cleanup() {
   if [[ -n "$STAGING_DIR" && -d "$STAGING_DIR" ]]; then
@@ -56,7 +57,7 @@ if [[ ! "$COMPOSE_PROJECT_NAME" =~ ^[a-z0-9][a-z0-9_-]*$ ]]; then
   exit 1
 fi
 
-validate_data_path() {
+validate_absolute_path() {
   local name="$1"
   local value="$2"
   if [[ -z "$value" || "$value" != /* || ! "$value" =~ ^/[A-Za-z0-9._/-]+$ ]]; then
@@ -70,8 +71,16 @@ validate_data_path() {
   fi
 }
 
-validate_data_path POSTGRES_DATA_DIR "$POSTGRES_DATA_DIR"
-validate_data_path STORAGE_HOST_DIR "$STORAGE_HOST_DIR"
+paths_overlap() {
+  local first="$1"
+  local second="$2"
+  [[ "$first" == "$second" || "$first" == "$second"/* || "$second" == "$first"/* ]]
+}
+
+validate_absolute_path REMOTE_DIR "$REMOTE_DIR"
+validate_absolute_path REMOTE_ENV_FILE "$REMOTE_ENV_FILE"
+validate_absolute_path POSTGRES_DATA_DIR "$POSTGRES_DATA_DIR"
+validate_absolute_path STORAGE_HOST_DIR "$STORAGE_HOST_DIR"
 if [[ "$POSTGRES_DATA_DIR" == "$STORAGE_HOST_DIR" \
   || "$POSTGRES_DATA_DIR" == "$STORAGE_HOST_DIR"/* \
   || "$STORAGE_HOST_DIR" == "$POSTGRES_DATA_DIR"/* ]]; then
@@ -82,6 +91,23 @@ if [[ "$DEPLOY_DATA_MODE" != "existing" && "$DEPLOY_DATA_MODE" != "initialize" ]
   echo "[ERROR] DEPLOY_DATA_MODE 必须显式设为 existing 或 initialize" >&2
   exit 1
 fi
+if paths_overlap "$REMOTE_DIR" "$POSTGRES_DATA_DIR"; then
+  echo "[ERROR] POSTGRES_DATA_DIR 不得与 REMOTE_DIR 同目录或相互嵌套，避免源码同步触碰数据库" >&2
+  exit 1
+fi
+if paths_overlap "$REMOTE_DIR" "$STORAGE_HOST_DIR"; then
+  echo "[ERROR] STORAGE_HOST_DIR 不得与 REMOTE_DIR 同目录或相互嵌套，避免源码同步触碰附件" >&2
+  exit 1
+fi
+if [[ "$REMOTE_ENV_FILE" == "$REMOTE_DIR" ]]; then
+  echo "[ERROR] REMOTE_ENV_FILE 不得等于 REMOTE_DIR" >&2
+  exit 1
+fi
+if [[ "$REMOTE_ENV_FILE" == "$REMOTE_DIR"/* ]]; then
+  REMOTE_ENV_RELATIVE="${REMOTE_ENV_FILE#"$REMOTE_DIR"/}"
+  RSYNC_PROTECT_ARGS+=(--filter="protect /${REMOTE_ENV_RELATIVE}")
+  RSYNC_PROTECT_ARGS+=(--exclude="/${REMOTE_ENV_RELATIVE}")
+fi
 
 if [[ ! -f "${ROOT_DIR}/${PROVENANCE_SCRIPT}" ]]; then
   echo "[ERROR] 缺少 ${PROVENANCE_SCRIPT}" >&2
@@ -139,6 +165,7 @@ ssh "${DEPLOY_SERVER}" "mkdir -p '${REMOTE_DIR}'"
 
 echo ">>> 4. 同步已验证提交到服务器"
 rsync -az --delete \
+  "${RSYNC_PROTECT_ARGS[@]}" \
   --exclude '.git' \
   --exclude '.github' \
   --exclude '.agent' \