fix(ci): 部署脚本 —— 私钥清理 trap 前移 + rsync 空目录守卫 + 主机密钥 accept-new(评审 Critical/Important)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/ci/deploy-site.sh

@@ -10,8 +10,20 @@ set -euo pipefail
 # shellcheck source=scripts/ci/lib-ssh.sh
 . scripts/ci/lib-ssh.sh
 
+# setup_ssh registers the EXIT cleanup trap itself (before writing the key),
+# so a mid-setup failure still cleans up — see lib-ssh.sh.
 setup_ssh
-trap teardown_ssh EXIT
+
+# Guard against deploying a missing/empty build: `rsync --delete` against an
+# empty source would wipe the live site.
+if [ ! -d web/website/dist ]; then
+  echo "==> deploy-site: web/website/dist/ does not exist — refusing to deploy" >&2
+  exit 1
+fi
+if ! find web/website/dist -mindepth 1 -print -quit | grep -q .; then
+  echo "==> deploy-site: web/website/dist/ is empty — refusing to deploy" >&2
+  exit 1
+fi
 
 DEPLOY_TARGET="root@${DEPLOY_HOST}:/var/www/pangolin-site/"
 echo "==> deploy-site: rsync web/website/dist/ -> ${DEPLOY_TARGET}"