ops: harden deploy exit and rollback handling

scripts/deploy-github.sh

@@ -21,9 +21,15 @@ cd "$APP"
 export GIT_SSH_COMMAND="ssh -i $KEY -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"
 exec > >(tee -a "$LOG") 2>&1
 
+cleanup() {
+  set +e
+  git worktree remove --force "$STAGE" >/dev/null 2>&1 || true
+  rm -rf "$STAGE"
+  docker image rm "$API_TEST_IMAGE" "$WEB_TEST_IMAGE" >/dev/null 2>&1 || true
+}
+
 publish_status() {
   local rc="${1:-1}"
-  trap - EXIT ERR
   set +e
 
   local outcome="failure"
@@ -63,20 +69,21 @@ publish_status() {
 
   rm -f "$status_file" "$log_file"
 }
-trap 'rc=$?; publish_status "$rc"; exit "$rc"' EXIT
 
-cleanup() {
-  set +e
-  git worktree remove --force "$STAGE" >/dev/null 2>&1 || true
-  rm -rf "$STAGE"
-  docker image rm "$API_TEST_IMAGE" "$WEB_TEST_IMAGE" >/dev/null 2>&1 || true
+on_exit() {
+  local rc=$?
+  trap - EXIT ERR
+  cleanup
+  publish_status "$rc"
+  exit "$rc"
 }
-trap cleanup RETURN
+trap on_exit EXIT
 
 rollback() {
   local rc=$?
   trap - ERR
   PHASE="rollback"
+
   echo
   echo "============================================================"
   echo " DH V2 · DEPLOY FALLÓ · ROLLBACK"
@@ -98,13 +105,12 @@ rollback() {
   echo
   echo "Backup PRE disponible en: $BACKUP"
   echo "Las migraciones son forward-only; database-before.dump queda disponible para restauración manual si hiciera falta."
-  cleanup
   exit "$rc"
 }
 trap rollback ERR
 
 echo
- echo "============================================================"
+echo "============================================================"
 echo " DH V2 · DEPLOY DESDE GITHUB · $DEPLOY_REF"
 echo "============================================================"
 
@@ -133,7 +139,6 @@ echo "Objetivo: $TARGET_SHA"
 if [ "$TARGET_SHA" = "$PREV_SHA" ]; then
   echo "Producción ya está en el commit autorizado."
   PHASE="complete"
-  cleanup
   exit 0
 fi
 
@@ -271,7 +276,6 @@ chmod 600 "$BACKUP"/* "$BACKUP/.env" 2>/dev/null || true
 
 PHASE="complete"
 trap - ERR
-cleanup
 
 echo
 echo "============================================================"