deploy: atomic binary replace (fix "Text file busy")

cp over /opt/remoterig/remoterig fails with "Text file busy" once the
service is running. Copy to a .new file and rename over the target
(works on a live binary), in both the deploy and rollback paths.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/deploy.sh

@@ -72,8 +72,12 @@ fi
 # 2. Deploy new binary
 # ---------------------------------------------------------------------------
 info "Deploying new binary..."
-cp "${BINARY}" "${DEPLOY_PATH}"
+# Atomic replace: copy alongside then rename over the target. A plain
-chmod +x "${DEPLOY_PATH}"
+# cp over a running executable fails with "Text file busy"; rename swaps
+# the directory entry and works while the old binary is still running.
+cp "${BINARY}" "${DEPLOY_PATH}.new"
+chmod +x "${DEPLOY_PATH}.new"
+mv -f "${DEPLOY_PATH}.new" "${DEPLOY_PATH}"
 ok "Binary installed at ${DEPLOY_PATH}"
 
 # ---------------------------------------------------------------------------
@@ -116,8 +120,9 @@ else
     # -----------------------------------------------------------------------
     if [ -f "${BACKUP}" ]; then
         info "Restoring backup: ${BACKUP}"
-        cp "${BACKUP}" "${DEPLOY_PATH}"
+        cp "${BACKUP}" "${DEPLOY_PATH}.new"
-        chmod +x "${DEPLOY_PATH}"
+        chmod +x "${DEPLOY_PATH}.new"
+        mv -f "${DEPLOY_PATH}.new" "${DEPLOY_PATH}"
 
         systemctl restart "${SERVICE}" 2>/dev/null || true