fix(ci): 服务端流水线注入加固(tag 校验/JSON 转义/workflow env)+ gitignore server/out

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013nMthbVEmQquxBRKb9Fj8u

scripts/ci/deploy-server.sh

@@ -17,6 +17,16 @@ DB=/var/lib/pangolin/pangolin.db
 BIN=/usr/local/bin
 TAG="${1:?usage: deploy-server.sh <tag>}"
 
+# Refuse anything that isn't a strict server-vX.Y.Z[-suffix] tag before it can
+# reach the remote heredoc / backup paths below (command-injection guard).
+# An anchored regex is used instead of a `case` glob: a trailing `*` in a
+# case pattern matches ANY trailing characters (including shell metachars
+# like `; rm -rf /`), which would defeat the point of this check.
+if ! [[ "$TAG" =~ ^server-v[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.]+)?$ ]]; then
+  echo "deploy-server: refusing unexpected tag '$TAG'" >&2
+  exit 1
+fi
+
 # setup_ssh registers the EXIT cleanup trap itself (before writing the key),
 # so a mid-setup failure still cleans up — see lib-ssh.sh. It exports
 # SSH_KEY_FILE / DEPLOY_PORT / SSH_KNOWN_HOSTS_FILE / DEPLOY_HOST used below