fix(deploy): sync worktree to HEAD inside post-receive

The server-side .git/config sets receive.denyCurrentBranch=updateInstead,
which auto-updates the worktree but bypasses the post-receive hook entirely.
Changing it to false restores hook execution; adding git reset --hard HEAD
inside the hook compensates for the lost auto-update so the build uses the
just-pushed source code.

.githooks/post-receive

@@ -10,6 +10,18 @@ export NVM_DIR="$HOME/.nvm"
 REPO_TOPLEVEL="$(git rev-parse --show-toplevel 2>/dev/null || echo "$PWD")"
 cd "$REPO_TOPLEVEL" || { echo "FATAL: cannot cd to $REPO_TOPLEVEL" >&2; exit 1; }
 
+# ============================================================
+# 0. sync_worktree —— 将**工**作**树**同步到**新** push 的 HEAD
+#   背景：服务器 .git/config 设了 receive.denyCurrentBranch=updateInstead 时
+#        git 自**动**更**新**工作**树**但**会**跳过**此**钩子；**改**为 false 后
+#        git **不**会**更**新**工作**树**，**手**动 reset --hard 同步**才**能**让**下**面**
+#        的 build **用**上**新**代**码**。
+# ============================================================
+sync_worktree() {
+    echo "=== sync_worktree: git reset --hard HEAD @ $(date -u +%Y-%m-%dT%H:%M:%SZ) ==="
+    git reset --hard HEAD
+}
+
 # ============================================================
 # 1. init_log_file —— 定**义** LOG_FILE + 创**建** logs/ 目**录**
 # ============================================================
@@ -115,6 +127,7 @@ log_abort() {
 # ============================================================
 main() {
     init_log_file
+    sync_worktree            # **先**同步工作**树**到**新** HEAD（**与** git config denyCurrentBranch 配**合**）
     write_metadata_header    # **先**覆盖写元信息（**这**样 env copy 日**志****能**保留在**后**面）
     copy_env_by_branch       # **追**加 env copy 日志