[P0][deploy] Tighten deployment safeguards (clean checkout, atomic rollback, separate status reporting)

[psam21]

Migrated from docs/pending-work-plan.md §9.

Problem

The deployment process needs tightening before the next production push. The current script has gaps that can lead to silent partial deployments or misleading "deployment verification complete" messages.

Required changes

1. Deploy only from a clean main checkout (no uncommitted changes, no diverged branch).
2. Use the canonical repository script (deploy/ns-deploy-full.sh); the bootstrap script must hand off before executing deployment logic.
3. Preserve production .env and persistent data across deployments.
4. Validate artifact completeness before swap (binary exists, templates exist, static assets exist).
5. Verify both services functionally — not just process status.
6. Blossom deployment must include a pre-swap validation of the extracted artifact.
7. Blossom deployment must include a post-restart upload smoke test (see [P0][blossom] Add functional upload test matrix (auth, hash, MIME, size, storage) #103).
8. The rollback trap must cover failures after Blossom is swapped but before the whole deployment completes, including a relay restart failure. The current logic marks Blossom deployed before the relay restart; if the relay restart then fails, the relay is restored but Blossom is not automatically restored. That may be acceptable if explicitly intended, but it is not an atomic two-service rollback and must be documented or corrected.
9. The script must print separate statuses for:
   • Relay process
   • Blossom process
   • Direct event totals
   • Grouped telemetry
   • Upload functionality
10. Secret-bearing commands must redirect only safe status output and must not include environment files or full process environments.

Acceptance criteria

• Deployment fails fast on a dirty checkout.
• Atomic two-service rollback (or documented non-atomic behavior).
• Deployment log shows five separate status lines (process × 2, totals, telemetry, uploads).
• No secrets in any deployment log.

Dependencies

• Depends on [P0][deploy] Correct deployment verification to recognize partial telemetry readiness #106 (verification must distinguish partial readiness).
• Depends on [P0][blossom] Add functional upload test matrix (auth, hash, MIME, size, storage) #103 (upload smoke test must exist).
• Blocks no other issues.

Source

Migrated from docs/pending-work-plan.md §9.

[psam21]

Dependency map:

• Blocked by [P0][blossom] Add functional upload test matrix (auth, hash, MIME, size, storage) #103 (upload smoke test must exist).
• Blocked by [P0][deploy] Correct deployment verification to recognize partial telemetry readiness #106 (corrected verification must exist).
• Blocked by [P0][relay] Investigate and contain relay OOM restarts #107 (OOM investigation must be contained).
• Blocks [P1][validation] Define and execute the full validation matrix from a clean checkout #112 (validation matrix references this issue).