fix(deploy): 群晖没有 pgrep，那三处「守卫」一直是空转

上一版给 push.sh 加的 pid 比对刚跑就露馅了：`sh: pgrep: command not found`，
于是 BEFORE 和 AFTER 都是空字符串，`[ -n "$BEFORE" ]` 直接跳过检查——我刚加
的安全网自己就是个摆设。

顺手查了一圈，stop.sh 和 start.sh 里同样的 pgrep 也一直在空转：
- stop.sh 的 `pgrep ... || exit 0` 每次都以 127 失败，永远匹配不到那个提前
  返回，所以每次停服都白等满 15 秒，也从没真正确认过残留 worker 已经没了。
- start.sh 的等待循环同理，白等 20 秒。

DSM 有 pkill 没有 pgrep，而且非特权的 ps 看不见 root 起的进程（服务是开机
以 root 启动的），两者任一都会让检查静默返回「没有」——这正是最危险的答案，
因为它长得和「已经停干净了」一模一样。

- push.sh 改用 `sudo ps -eo pid,args | grep`；并且 AFTER 为空时直接报错退出，
  不再把「看不见」当成「通过」
- stop.sh / start.sh 改用 `ps -eo args | grep -q`

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/push.sh

@@ -79,7 +79,15 @@ $TAR -C "$REPO/client/build" . | sh_ "tar xzf - -C '$STATIC'"
 # Hence sudo, matching how the service actually runs.
 SUDO="echo '$PASS' | sudo -S"
 echo "==> restart (sudo: the service runs as root, started at boot)"
-BEFORE=$(sh_ "pgrep -f '$APP/backend/.venv/bin/gunicorn' | tr '\n' ',' " || true)
+# DSM has no pgrep, and an unprivileged `ps` cannot see a root-owned process
+# — either one silently returns nothing, which would make the pid comparison
+# below always "pass" and put the check right back where it started.
+pids_() {
+  sh_ "echo '$PASS' | sudo -S ps -eo pid,args 2>/dev/null \
+       | grep '$APP/backend/.venv/bin/gunicorn' | grep -v grep \
+       | awk '{print \$1}' | sort -n | tr '\n' ','"
+}
+BEFORE=$(pids_ || true)
 sh_ "cd '$APP' && $SUDO sh deploy/stop.sh >/dev/null 2>&1; sleep 3; $SUDO sh deploy/start.sh" \
   || { echo "restart failed" >&2; exit 1; }
 
@@ -89,8 +97,13 @@ sh_ "curl -sf -m 5 -o /dev/null -w 'local api: %{http_code}\n' \
 
 # A 200 alone proves nothing: it is exactly what a surviving old master
 # returns. The master pid must have changed for the new code to be loaded.
-AFTER=$(sh_ "pgrep -f '$APP/backend/.venv/bin/gunicorn' | tr '\n' ',' " || true)
-if [ -n "$BEFORE" ] && [ "$BEFORE" = "$AFTER" ]; then
+AFTER=$(pids_ || true)
+if [ -z "$AFTER" ]; then
+  echo "cannot see any gunicorn process - the pid check could not run." >&2
+  echo "Verify by hand before trusting this deploy." >&2
+  exit 1
+fi
+if [ "$BEFORE" = "$AFTER" ]; then
   echo "the gunicorn pids did not change ($AFTER) - the old process is still" >&2
   echo "serving and your changes are NOT live. Check $APP/logs/error.log." >&2
   exit 1