fix(deploy): migrate PAC explicitly before replacing app containers

deploy/deploy-prod.sh

@@ -125,18 +125,23 @@ main() {
       fi
     done
   fi
+  # 迁移明确先完成，再替换业务容器；--no-deps 下不依赖 Compose 隐式排序。
+  log "执行数据库迁移"
+  "${COMPOSE[@]}" run --rm --no-deps pac-migrate
+  local RUNTIME_SERVICES=(pac-service pac-web)
+  [[ "${WITH_ASR:-0}" == "1" ]] && RUNTIME_SERVICES+=(pac-asr)
   log "force-recreate(不信 compose 的重建判定)"
-  if ! "${COMPOSE[@]}" up -d --no-deps --force-recreate "${SERVICES[@]}"; then
+  if ! "${COMPOSE[@]}" up -d --no-deps --force-recreate "${RUNTIME_SERVICES[@]}"; then
     warn "force-recreate 失败(疑似 rootless 删不掉运行中容器的网络进程),回退:清残留 → stop → 重建"
     local proj_r svc_r leftover
     proj_r=$(basename "$PWD")
-    for svc_r in "${SERVICES[@]}"; do
+    for svc_r in "${RUNTIME_SERVICES[@]}"; do
       # 失败会留下带 hash 前缀的半成品容器(如 b69b5bec_pac-pac-service-1),不清则重建报名字冲突
       leftover=$(docker ps -a --format '{{.Names}}' 2>/dev/null | grep -E "_${proj_r}-${svc_r}-1$" || true)
       [[ -n "$leftover" ]] && docker rm -f $leftover >/dev/null 2>&1 && log "  清理残留容器 $leftover"
     done
-    "${COMPOSE[@]}" stop "${SERVICES[@]}" || true
-    "${COMPOSE[@]}" up -d --no-deps --force-recreate "${SERVICES[@]}"
+    "${COMPOSE[@]}" stop "${RUNTIME_SERVICES[@]}" || true
+    "${COMPOSE[@]}" up -d --no-deps --force-recreate "${RUNTIME_SERVICES[@]}"
   fi
 
   # ── 部署后硬验证:任一不过 = 部署失败 ─────────────────────────────
@@ -150,10 +155,8 @@ main() {
     echo "  $svc OK (${want:7:12})"
   done
 
-  log "验证 2/3:数据库迁移无 pending(migrate 容器 exit 0 且 deploy 干净)"
-  local mexit status_out
-  mexit=$(docker inspect "${proj}-pac-migrate-1" --format '{{.State.ExitCode}}')
-  [[ "$mexit" == "0" ]] || die "migrate 容器 exit=$mexit(看 docker logs ${proj}-pac-migrate-1)"
+  log "验证 2/3:数据库迁移无 pending(迁移命令成功且 status 干净)"
+  local status_out
   # 注 1:prisma 的"新版本提示框"位置不固定(异步)→ 不能 tail 截断,全量输出里找;
   # 注 2:pipefail 下 `cmd | grep -q` 会因 grep 提前退出给 cmd 发 SIGPIPE → 管道 141 误判失败
   #       → 先落变量再 grep。