feat(ops): prod timezone probe, web/app container sync, and D-01 agent upgrade.

Unify upgrade-agent with install.sh via agent_deploy; auto-sync Git web/app after
Docker upgrade to prevent vite hash drift; extend prod_probe for Beijing TZ checks.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/deploy-frontend.sh

@@ -19,21 +19,33 @@ echo "═══ Nexus Frontend Deploy ═══"
 
 REMOTE_RUNTIME=$(ssh_cmd 'bash -s' <<'REMOTE'
 set -euo pipefail
+docker_cmd() {
+  if docker "$@" 2>/dev/null; then return 0; fi
+  sudo docker "$@" 2>/dev/null
+}
+compose_cmd() {
+  if docker compose "$@" 2>/dev/null; then return 0; fi
+  sudo docker compose "$@" 2>/dev/null
+}
 for d in /opt/nexus /www/wwwroot/api.synaglobal.vip; do
   [[ -d "$d/server" ]] || continue
-  if [[ -f "$d/docker/.env.prod" ]] && docker compose version >/dev/null 2>&1; then
+  if [[ -f "$d/docker/.env.prod" ]] && compose_cmd version >/dev/null 2>&1; then
     prof="$d/docker/.host-profile"
     [[ -f "$prof" ]] || prof="$d/docker/profiles/2c8g.env"
     if [[ -f "$prof" ]]; then
       args=(-f "$d/docker/docker-compose.prod.yml")
-      docker network inspect 1panel-network >/dev/null 2>&1 && \
+      docker_cmd network inspect 1panel-network >/dev/null 2>&1 && \
         [[ -f "$d/docker/docker-compose.1panel.yml" ]] && \
         args+=(-f "$d/docker/docker-compose.1panel.yml")
-      q=$(cd "$d" && docker compose "${args[@]}" \
+      q=$(cd "$d" && compose_cmd "${args[@]}" \
         --env-file "$d/docker/.env.prod" --env-file "$prof" ps -q nexus 2>/dev/null || true)
       [[ -n "$q" ]] && echo "docker $d" && exit 0
     fi
   fi
+  if [[ -f "$d/deploy/nexus-1panel.sh" ]]; then
+    q=$(docker_cmd ps --format '{{.Names}}' 2>/dev/null | grep -E '^nexus-prod-nexus-' || true)
+    [[ -n "$q" ]] && echo "docker $d" && exit 0
+  fi
   if command -v supervisorctl >/dev/null 2>&1 && supervisorctl status nexus >/dev/null 2>&1; then
     echo "supervisor $d"
     exit 0