修正CEO报销财务兜底与部署护栏（07-28-ceo-finance-fallback）

scripts/qa/run-backup-restore-drill.sh

@@ -86,6 +86,30 @@ if command -v node >/dev/null 2>&1; then
     exit 1
   fi
 
+  if deploy_error="$(DEPLOY_SERVER=unused REMOTE_DIR=/srv/hyb-oa/app \
+    POSTGRES_DATA_DIR=/srv/hyb-oa/app/data/postgres \
+    STORAGE_HOST_DIR=/srv/hyb-oa/storage DEPLOY_DATA_MODE=existing \
+    "$ROOT_DIR/deploy/trialrun/deploy.sh" 2>&1)"; then
+    echo "[ERR] formal deploy accepted PostgreSQL data nested in the source sync root" >&2
+    exit 1
+  fi
+  if [[ "$deploy_error" != *"POSTGRES_DATA_DIR 不得与 REMOTE_DIR"* ]]; then
+    echo "[ERR] nested PostgreSQL path did not fail at the source-sync isolation guard" >&2
+    exit 1
+  fi
+
+  if deploy_error="$(DEPLOY_SERVER=unused REMOTE_DIR=/srv/hyb-oa/app \
+    POSTGRES_DATA_DIR=/srv/hyb-oa/postgres \
+    STORAGE_HOST_DIR=/srv/hyb-oa/app/data/storage DEPLOY_DATA_MODE=existing \
+    "$ROOT_DIR/deploy/trialrun/deploy.sh" 2>&1)"; then
+    echo "[ERR] formal deploy accepted attachment storage nested in the source sync root" >&2
+    exit 1
+  fi
+  if [[ "$deploy_error" != *"STORAGE_HOST_DIR 不得与 REMOTE_DIR"* ]]; then
+    echo "[ERR] nested storage path did not fail at the source-sync isolation guard" >&2
+    exit 1
+  fi
+
   MUTATED_PORT_COMPOSE="$DRILL_DIR/docker-compose-db-port.yml"
   sed '/  db:/a\    ports:\n      - "5432:5432"' \
     "$ROOT_DIR/deploy/trialrun/docker-compose.yml" >"$MUTATED_PORT_COMPOSE"