feat(launch): 命令面板+预发布验收+上线脚本（T1/T4/T5）

- T1 (op-gitea 车道)：CommandPalette 三层（动作 theme/lang/rss+导航
  zh/en+Pagefind 搜索），Ctrl K 与 / 入口，document 级委托修 ClientRouter
  换页绑定失效；连带修复动态结果节点的 scoped CSS 失效潜伏 bug
- T4：preflight.sh 17 项全绿（产物/hreflang/双轨/微信 UA 200/
  responsive 11/halo 无恙/回滚前置）；headless 渲染经 c4ai 复核
  （en 书评页全文+标注+ICP 实测在案）
- T5：launch.sh/rollback.sh 双向 dry-run 绿 + 上线检查单（linger/
  ESA 刷新/验证 URL/回滚路径）

验证: build 21 页 exit 0；command-palette+cmd-item zh/en 断言；
      bash scripts/preflight.sh ALL OK；launch/rollback dry-run exit 0

Spec: 2026-10-25_add-blog-launch
Co-authored-by: GLM-5.3

infra/deploy/launch.sh

@@ -0,0 +1,53 @@
+#!/bin/bash
+# 上线切换脚本（Phase 4 T5）：wait4x.online 从 Halo(18090) 切到静态 staging 目录。
+# 红线：默认 --dry-run 只打印；真实执行必须 root 显式跑（nginx 属 root 域）。
+# 回滚：rollback.sh（同目录，反向切换，同样 dry-run 默认）。
+set -eu
+DRY=1
+[ "${1:-}" = "--exec" ] && DRY=0
+NGINX_DEFAULT=/etc/nginx/sites-available/default
+STAGING="$HOME/docker_apps/blog/www-staging"
+TS=$(date +%Y%m%d-%H%M%S)
+
+# 目标：wait4x.online server 块内 location / 的 proxy_pass 换为静态 root。
+# 静态块特性：try_files + URI 归一化尾斜杠（Astro 目录式路由），保留既有 proxy 头段不做它用。
+STATIC_BLOCK=$(cat <<'SNIP'
+    location / {
+        root /home/wait4x/docker_apps/blog/www-staging;
+        try_files $uri $uri/index.html =404;
+    }
+SNIP
+)
+
+echo "== 上线切换计划 =="
+echo "  备份: $NGINX_DEFAULT -> default.bak-launch-$TS"
+echo "  切换: wait4x.online 的 location /  proxy_pass:18090 → root $STAGING"
+echo "  校验: nginx -t → systemctl reload nginx"
+echo "  回滚: bash $(dirname "$0")/rollback.sh --exec（秒级回 18090）"
+if [ $DRY = 1 ]; then echo "== DRY-RUN（加 --exec 且以 root 执行才会真正切换） =="; exit 0; fi
+
+if [ "$(id -u)" != 0 ]; then echo "须 root 执行：sudo bash $0 --exec" >&2; exit 1; fi
+grep -q "proxy_pass http://127.0.0.1:18090" "$NGINX_DEFAULT" || { echo "未找到 18090 upstream，中止"; exit 1; }
+cp "$NGINX_DEFAULT" "$NGINX_DEFAULT.bak-launch-$TS"
+python3 - "$NGINX_DEFAULT" <<'PY'
+import re, sys
+path = sys.argv[1]
+s = open(path, encoding="utf-8").read()
+lines = s.splitlines(keepends=True)
+start = next(i for i, l in enumerate(lines) if "server_name wait4x.online;" in l)
+depth = 0
+for i in range(start, len(lines)):
+    depth += lines[i].count("{") - lines[i].count("}")
+    if i > start and depth == 0:
+        end = i
+        break
+block = "".join(lines[start:end])
+new_block = re.sub(r"location / \{.*?\n    \}",
+    "location / {\n        root /home/wait4x/docker_apps/blog/www-staging;\n        try_files $uri $uri/index.html =404;\n    }",
+    block, count=1, flags=re.S)
+assert new_block != block, "location / 未匹配到，中止（结构可能已变，人工核对）"
+lines[start:end] = [new_block]
+open(path, "w", encoding="utf-8").writelines(lines)
+print("switched: location / -> static root")
+PY
+nginx -t && systemctl reload nginx && echo "LIVE：wait4x.online 现服务静态站（回滚：sudo bash $(dirname "$0")/rollback.sh --exec）"

infra/deploy/rollback.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+# 回滚脚本（launch.sh 的逆操作）：静态 root 切回 Halo proxy_pass(18090)。秒级。
+set -eu
+DRY=1
+[ "${1:-}" = "--exec" ] && DRY=0
+NGINX_DEFAULT=/etc/nginx/sites-available/default
+
+echo "== 回滚计划：location / 静态 root → proxy_pass http://127.0.0.1:18090 =="
+if [ $DRY = 1 ]; then echo "== DRY-RUN（--exec + root 才执行） =="; exit 0; fi
+if [ "$(id -u)" != 0 ]; then echo "须 root：sudo bash $0 --exec" >&2; exit 1; fi
+grep -q "docker_apps/blog/www-staging" "$NGINX_DEFAULT" || { echo "未找到静态 root，无需回滚或已回滚"; exit 0; }
+python3 - "$NGINX_DEFAULT" <<'PY'
+import re, sys
+path = sys.argv[1]
+s = open(path, encoding="utf-8").read()
+s2 = re.sub(
+    r"location / \{\n        root /home/wait4x/docker_apps/blog/www-staging;\n        try_files \$uri \$uri/index\.html =404;\n    \}",
+    """location / {
+        proxy_pass http://127.0.0.1:18090;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }""",
+    s, count=1)
+assert s2 != s, "静态块未匹配，人工核对"
+open(path, "w", encoding="utf-8").write(s2)
+print("reverted: location / -> halo 18090")
+PY
+nginx -t && systemctl reload nginx && echo "ROLLED BACK：wait4x.online 已回 Halo"