fix(deploy): retain previous release assets to close the stale-HTML window (HK-6)

[Hectormalvarez]

Problem

After every deploy that changes asset hashes, the edge-cached homepage (2 h Cache Rule TTL, ADR-0006) referenced assets that no longer existed on origin. Cloudflare cached the resulting 404s, breaking the homepage for up to 2 h per deploy. Observed live twice on 2026-09-14.

Fix (ADR-0007)

• scripts/deploy.sh - new step 3b streams the running web container assets into .prev-assets/ (accumulative, best-effort) before the container swap.
• docker-compose.prod.yml - web service bind-mounts .prev-assets read-only at /usr/share/nginx/html-prev.
• web/nginx.conf - location /assets/ falls back to @prev_assets (same immutable headers) for hashes missing from the new build.

Verification (local, CI-equivalents)

• sh -n scripts/deploy.sh; docker compose config -q on both stacks; nginx -t on both configs
• Functional docker test: old-hash asset served 200 via the fallback with immutable headers; new assets 200; unknown path 404; / and /healthz unaffected
• The first deploy after merge still runs the old in-memory deploy.sh; the fallback is fully populated from the second deploy onward (recorded in ADR-0007)

Docs

• New ADR-0007; ADR-0006 assumption amended; sprint/backlog/memory-bank updated.