deploying: replace the binary by rename, and prove it execs before restarting

Tonight's deploy silently did not happen. `cp` onto the live path writes new
bytes into the EXISTING inode, and macOS caches code-signature validation per
vnode -- so the next exec found bytes that did not match the cached verdict and
the kernel SIGKILLed it. No output, no error, exit 137.

Every surface kept saying the deploy worked. `ck module status` reported ok with
9 serving, because the supervisor was still running the OLD image; buildCommit
was the only field that disagreed, and only because I compared it. The single
tell anywhere was `last_exit: sig9` in the supervisor row, which nothing directs
a reader to.

Two changes. The copy is now cp-then-mv, so the live path gets a NEW inode with
no cached verdict and no window where the file is absent. And a one-second exec
check runs before the restart: a binary that cannot execute is caught at the step
that placed it, rather than in the verify step with a supervisor that has already
fallen back to an image nobody chose.

Mechanism confirmed rather than assumed: a fresh copy execs (exit 0), the same
file with one byte overwritten in place is SIGKILLed (exit 137). This is the
per-vnode caching measured during the syspolicyd work, arriving through the one
door the runbook opened every single deploy.

Author: ualtinok

docs/deploying.md

@@ -15,9 +15,22 @@ rather than inferred.
 # 1. build
 cargo build --release
 
-# 2. back up what is running, then replace it
+# 2. back up what is running, then replace it BY RENAME, never by overwrite.
+#    `cp` onto the live path writes new bytes into the EXISTING inode, and macOS
+#    caches code-signature validation per vnode -- so the next exec finds bytes
+#    that do not match the cached verdict and the kernel SIGKILLs it. Silently:
+#    no output, no error, exit 137, and `ck module status` keeps reporting `ok`
+#    from the process that is still running the OLD image. That is a deploy that
+#    did not happen while every surface says it did; the only tell is
+#    `last_exit: sig9` in the supervisor row.
 cp ~/.local/share/cortexkit/bin/ck-insula ~/.local/share/cortexkit/bin/ck-insula.bak
-cp target/release/ck-insula ~/.local/share/cortexkit/bin/ck-insula
+cp target/release/ck-insula ~/.local/share/cortexkit/bin/ck-insula.new
+mv -f ~/.local/share/cortexkit/bin/ck-insula.new ~/.local/share/cortexkit/bin/ck-insula
+
+# 2b. prove the file you just placed can EXECUTE before restarting anything.
+#     One second, and it is the difference between finding this now and finding
+#     it in step 4 with a supervisor that has already fallen back.
+~/.local/share/cortexkit/bin/ck-insula --version    # must print, must exit 0
 
 # 3. restart under supervision
 ck module restart insula