fix(deploy): guard staging builds on business host

docs/V21-UI-ACCEPTANCE-CHECKLIST.md

@@ -166,3 +166,10 @@ V21 结构：三张套餐 feature 卡片，免费版/专业版/企业版，推
 - Staging Web 构建在拉取 docker.m.daocloud.io/library/node:20 时卡住，属于外网基础镜像依赖问题。
 - deploy-staging.sh 已改为默认复用现有 Web 镜像；如需重建 Web，显式设置 BUILD_WEB=1。
 
+
+## 2026-06-24 服务器职责混淆纠正
+
+- 老大纠正：项目已有两台服务器与职责分离约定，本次问题是执行时再次混淆职责。
+- 已回滚危险 artifact build workflow：b01ae28 Revert "fix(deploy): build staging web artifact"。
+- 已给 deploy-staging.sh 增加硬保护：默认禁止 REBUILD_BACKEND=1 或 BUILD_WEB=1 在业务/staging deploy 路径上构建镜像；只有显式 ALLOW_STAGING_BUILDS=true 才允许在专用构建机执行。
+- 后续正式方案：CI/构建服务器产出 dist/image，业务服务器只接收产物并重启服务。

infra/docker/deploy-staging.sh

@@ -35,6 +35,14 @@ export WEB_PORT
 export DOCKER_BUILDKIT=0
 export COMPOSE_DOCKER_CLI_BUILD=0
 
+if [ "${REBUILD_BACKEND:-0}" = "1" ] || [ "${BUILD_WEB:-0}" = "1" ]; then
+  if [ "${ALLOW_STAGING_BUILDS:-false}" != "true" ]; then
+    echo "❌ Staging deploy must not build images on the business server."
+    echo "   Build artifacts/images on the dedicated CI/build server, then deploy with REBUILD_BACKEND=0 BUILD_WEB=0."
+    exit 1
+  fi
+fi
+
 if [ "${REBUILD_BACKEND:-0}" = "1" ]; then
   docker compose build --pull=false api
   docker compose build --pull=false worker