Defer server file changes until guarded restart activation

Persist beta, promotion, drift, and rollback payloads until occupancy and restart-capacity checks pass. Preserve rollback snapshots and campaign ordering, and allow held rollback campaigns to resume safely.

Fixes #28

Validation: 805 tests passed, Svelte checks clean, production build passed.

src/lib/server/provisioning/requests.ts

@@ -51,11 +51,17 @@ export function requestRestart(server: string, source: RestartSource): Lifecycle
         }
         // Only not-yet-submitted campaign changes can share an activation. A later
         // file deployment must never be credited to an already running restart.
-        if (source.kind === 'campaign' && !row.restarted_at) {
+        // Restorations need their own activation. An older campaign can have
+        // stale file preconditions after a beta; its failure must not strand
+        // the rollback that would restore the server.
+        const rollback = source.kind === 'campaign' && !!db().prepare("SELECT 1 FROM deployments WHERE id = ? AND action = 'rollback'").get(source.id);
+        if (source.kind === 'campaign' && !row.restarted_at && !rollback) {
             id = (db().prepare(`SELECT d.id FROM server_deployments d WHERE d.server = ? AND d.server_deleted_at IS NULL AND d.action = 'restart'
                 AND d.state = 'waiting' AND d.submitted_at IS NULL
                 AND EXISTS (SELECT 1 FROM provisioning_sources s WHERE s.operation_id = d.id AND s.kind = 'campaign')
                 AND NOT EXISTS (SELECT 1 FROM provisioning_sources s WHERE s.operation_id = d.id AND s.kind != 'campaign')
+                AND NOT EXISTS (SELECT 1 FROM provisioning_sources s JOIN deployments c ON c.id = s.source_id
+                    WHERE s.operation_id = d.id AND s.kind = 'campaign' AND c.action = 'rollback')
                 ORDER BY d.rowid LIMIT 1`).get(server) as { id: string } | undefined)?.id;
         }
         if (!id) {