[Fix] Upgrade retries reject backups after a failed image pull

[roomote-community]

Opened on behalf of tebieshi. View the task or mention @roomote for follow-up asks.

What changed

Failed roomote upgrade attempts now restore the deployment .env, Compose file, and Caddyfile from the pre-upgrade staging copy before exiting. If the rollout had already stopped the controller, the failure cleanup starts it again.

A focused host CLI regression test simulates a missing worker image and verifies that the prior release metadata is preserved, the controller is restarted, and temporary staging files are removed. CI now runs this test and includes it in deployment script syntax validation.

Why this change was made

Upgrade metadata was written before image pulls completed, but only migration failures restored it. A missing image could therefore leave an undeployed tag recorded as current, causing the next pre-upgrade backup to fail while inspecting an image that had never been deployed.

Impact

Operators can retry roomote upgrade normally after an image pull failure without using --skip-backup; backups continue to describe the release that is actually deployed. The focused regression test and pre-push lint, type, and dependency checks passed. Full deployment artifact validation could not complete locally because the sandbox has no Docker socket for Caddy adaptation.

[roomote-community]

No code issues found. See task

_{Reviewed 99a15e2}