修复维护模式失败路径临时文件清理

在首次创建临时文件前注册 set -u 安全的统一 EXIT 清理。

补充 marker 与公告页符号链接失败后的临时文件残留回归断言。

更新生产运维文档中的维护页临时文件安全边界。

scripts/deploy/maintenance-on.sh

@@ -6,6 +6,19 @@ MAINTENANCE_FILE="${GENARRATIVE_MAINTENANCE_FILE:-/var/lib/genarrative/maintenan
 MAINTENANCE_PAGE_FILE="${GENARRATIVE_MAINTENANCE_PAGE_FILE:-/var/lib/genarrative/maintenance/page.html}"
 PAGE_SOURCE=""
 REASON_PARTS=()
+page_temp=""
+marker_temp=""
+
+cleanup_temps() {
+  if [[ -n "${page_temp}" ]]; then
+    rm -f -- "${page_temp}"
+  fi
+  if [[ -n "${marker_temp}" ]]; then
+    rm -f -- "${marker_temp}"
+  fi
+}
+
+trap cleanup_temps EXIT
 
 replace_file_atomically() {
   local source_file="$1"
@@ -56,7 +69,6 @@ mkdir -p "$(dirname "${MAINTENANCE_FILE}")" "$(dirname "${MAINTENANCE_PAGE_FILE}
 
 if [[ -n "${PAGE_SOURCE}" ]]; then
   page_temp="$(mktemp "${MAINTENANCE_PAGE_FILE}.tmp.XXXXXX")"
-  trap 'rm -f "${page_temp:-}" "${marker_temp:-}"' EXIT
   install -m 0644 -- "${PAGE_SOURCE}" "${page_temp}"
   replace_file_atomically "${page_temp}" "${MAINTENANCE_PAGE_FILE}"
   page_temp=""