minimal 备份增加 freeze 副本路径

- database-backup-to-oss.mjs 新增 --freeze-dir：minimal 模式先把选中子集 rsync 成冻结副本（保持原始相对路径）再从副本上传，避免热备时最新 commitlog 持续追加触发 stat 漂移失败
- files-minimal systemd 模板与发布前 minimal 备份默认传入 freeze 目录
- 生产运维门禁同步 freeze 口径断言

scripts/deploy/production-stdb-publish.sh

@@ -856,7 +856,12 @@ case "${BACKUP_MODE}" in
     )
     if [[ "${BACKUP_MINIMAL}" == "1" ]]; then
       echo "[production-stdb-publish] publish 前执行 minimal 热备（最近 ${BACKUP_RETAIN_SNAPSHOTS} 份 snapshot + 其后 commitlog），不停服务"
-      SYNC_BACKUP_ARGS+=(--mode full --minimal --retain-snapshots "${BACKUP_RETAIN_SNAPSHOTS}")
+      SYNC_BACKUP_ARGS+=(
+        --mode full
+        --minimal
+        --retain-snapshots "${BACKUP_RETAIN_SNAPSHOTS}"
+        --freeze-dir "${GENARRATIVE_STDB_PUBLISH_BACKUP_FREEZE_DIR:-/var/lib/genarrative/database-backups/publish-minimal-freeze}"
+      )
     else
       echo "[production-stdb-publish] publish 前同步执行 OSS 冷备份（storage-format=${BACKUP_STORAGE_FORMAT}），失败会阻断发布"
       SYNC_BACKUP_ARGS+=(--stop-service spacetimedb.service)