feat(ops): protect complete pre-deploy recovery set

.gitea/workflows/ci-deploy.yml

@@ -312,10 +312,13 @@ jobs:
     steps:
       - name: Run remote deploy
         uses: appleboy/ssh-action@v1.0.3
+        env:
+          MAINTENANCE_GITEA_TOKEN: ${{ secrets.MAINTENANCE_GITEA_TOKEN }}
         with:
           host: ${{ secrets.PROD_HOST }}
           username: ${{ secrets.PROD_USER }}
           key: ${{ secrets.PROD_SSH_KEY }}
+          envs: MAINTENANCE_GITEA_TOKEN
           command_timeout: 40m
           script: |
             set -euo pipefail
@@ -324,6 +327,24 @@ jobs:
               exit 1
             fi
             cd /opt/job-tracker/app
+            if [ -z "${MAINTENANCE_GITEA_TOKEN:-}" ]; then
+              echo "MAINTENANCE_GITEA_TOKEN is not configured as a repository Actions secret."
+              exit 1
+            fi
+            shared_env=/opt/job-tracker/shared/.env
+            if [ ! -f "$shared_env" ]; then
+              echo "Expected deployment environment at $shared_env."
+              exit 1
+            fi
+            env_tmp="$(mktemp)"
+            trap 'rm -f "$env_tmp"' EXIT
+            grep -v '^MAINTENANCE_GITEA_TOKEN=' "$shared_env" > "$env_tmp"
+            printf 'MAINTENANCE_GITEA_TOKEN=%s\n' "$MAINTENANCE_GITEA_TOKEN" >> "$env_tmp"
+            chmod --reference="$shared_env" "$env_tmp"
+            cat "$env_tmp" > "$shared_env"
+            rm -f "$env_tmp"
+            trap - EXIT
+            unset MAINTENANCE_GITEA_TOKEN
             if ! git fetch --all --prune; then
               echo "git fetch failed on server. Check remote auth/URL for /opt/job-tracker/app."
               exit 1