修正CEO报销财务兜底与部署护栏（07-28-ceo-finance-fallback）

deploy/trialrun/validate-env-contract.js

@@ -428,8 +428,14 @@ for (const requiredFragment of [
 }
 
 for (const requiredFragment of [
-  'validate_data_path POSTGRES_DATA_DIR "$POSTGRES_DATA_DIR"',
-  'validate_data_path STORAGE_HOST_DIR "$STORAGE_HOST_DIR"',
+  'validate_absolute_path REMOTE_DIR "$REMOTE_DIR"',
+  'validate_absolute_path REMOTE_ENV_FILE "$REMOTE_ENV_FILE"',
+  'validate_absolute_path POSTGRES_DATA_DIR "$POSTGRES_DATA_DIR"',
+  'validate_absolute_path STORAGE_HOST_DIR "$STORAGE_HOST_DIR"',
+  'paths_overlap "$REMOTE_DIR" "$POSTGRES_DATA_DIR"',
+  'paths_overlap "$REMOTE_DIR" "$STORAGE_HOST_DIR"',
+  'RSYNC_PROTECT_ARGS+=(--filter="protect /${REMOTE_ENV_RELATIVE}")',
+  'RSYNC_PROTECT_ARGS+=(--exclude="/${REMOTE_ENV_RELATIVE}")',
   'DEPLOY_DATA_MODE" != "existing"',
   'DEPLOY_DATA_MODE" != "initialize"',
   '"$POSTGRES_DATA_DIR/PG_VERSION"',