fix(deploy): preserve runtime ownership on installer reruns

Limit application data and log ownership changes to their top-level directories. Add a container check that reapplies installer permissions and verifies application startup.

Validation: first-install and repeated-install filesystem permission checks, Bash syntax, ShellCheck, Actionlint, and diff checks passed. Full local container validation was blocked by Docker Desktop bind-mount permission mapping.

Co-authored-by: Codex <noreply@openai.com>

.github/actions/verify-container/action.yml

@@ -154,6 +154,21 @@ runs:
         "${compose[@]}" exec -T codex-proxy-rs sh -c \
           'touch /app/.runtime/data/.ci-write /app/.runtime/logs/.ci-write && rm /app/.runtime/data/.ci-write /app/.runtime/logs/.ci-write'
 
+    - name: Verify application restart after installer permissions
+      shell: bash
+      run: |
+        set -euo pipefail
+        compose=(docker compose --project-name "$COMPOSE_PROJECT_NAME" \
+          -f deploy/compose.yaml)
+        "${compose[@]}" stop --timeout 30 codex-proxy-rs
+        # 使用安装器原函数，验证已有备份暂存目录与日志不会因所有权变更而阻止启动
+        (
+          export INSTALL_DIR="$PWD"
+          source deploy/install.sh
+          fix_runtime_permissions
+        )
+        "${compose[@]}" up -d --no-build --wait codex-proxy-rs
+
     - name: Verify clean logs and graceful shutdown
       shell: bash
       run: |

deploy/install.sh

@@ -226,8 +226,8 @@ fix_runtime_permissions() {
   run_root chown -R "$redis_ids" -- "${RUNTIME_DIR}/redis"
   run_root chmod 0750 -- "${RUNTIME_DIR}/redis"
 
-  # 保留安装用户对应用目录的所有权，并向容器实际运行组授予读写权限。
-  run_root chown -R "$(id -u):${app_gid}" -- "${RUNTIME_DIR}/data" "${RUNTIME_DIR}/logs"
+  # 只设置顶层目录，保留应用创建的私有目录与文件的所有权，确保重复安装后仍可读写
+  run_root chown "$(id -u):${app_gid}" -- "${RUNTIME_DIR}/data" "${RUNTIME_DIR}/logs"
   run_root chmod 0770 -- "${RUNTIME_DIR}/data" "${RUNTIME_DIR}/logs"
   run_root chown "$(id -u):${app_gid}" -- "$CONFIG_FILE"
   run_root chmod 0640 -- "$CONFIG_FILE"