Remove the release directory a failed deploy leaves behind

A deploy that died after mkdir -- a broken build, a missing lock file, a
health check that never went green -- left its half-finished release in
releases/. That is not just disk: it is the newest directory there, so the
KEEP=3 rotation of the next successful deploy counted it among the three to
keep and dropped a working release instead, thinning out exactly the rollback
targets the runbook tells you to use.

The release directory is now armed for cleanup the moment it is created and
disarmed once the release is live and healthy, with the removal done by the
same EXIT trap that drops the unpacked archive -- so it covers every way out:
fatal, a command failing under set -e, an aborted build. The one case left
alone is a release the swap did reach and that `current` still points at, i.e.
a first-ever deploy with nothing to roll back to: removing that would leave a
dangling symlink behind instead.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/README.md

@@ -267,7 +267,10 @@ cat /srv/exo/<app>/current/.deploy-source
 | Disk usage | `du -sh /srv/exo/*/releases/*` |
 
 `exo-deploy` health-checks after the swap and **rolls back automatically** if the new
-release fails to answer `/api/health`.
+release fails to answer `/api/health`. A deploy that fails anywhere — a broken build, a
+missing lock file, a health check that never goes green — takes its half-finished release
+directory with it, so the three kept releases are always three releases that actually ran
+and any one of them is a safe rollback target.
 
 ## Monitoring