scripts/deploy.sh: build go+rust -> install (not cp) -> stop/reload/start both -> verify (is-active, no (deleted) inode, running-binary checksum == this build, /health=200). --verify-only flag for check-only. make deploy points at this script (replaces stale /usr/local/bin system-level target). Counter-example: install stale sidecar -> service stays active + health=200 (silent pass) -> make deploy-verify exits non-zero (catches silent fault). PartOf=zhiyid.service drop-in on zhiyi-consolidate + ExecStartPre rm /tmp/zhiyi-ipc.sock; restarting zhiyid now restarts sidecar (ActiveEnterTimestamp updates). deploy/ dir aligned to reality and desensitized (3 plaintext keys removed). Key cleanup in git history is a separate track - this card does not touch history. ACs verified. go test internal/governance failures are pre-existing rename tests, unrelated (this card touches no go/ code).
小唯