bug(code-sync): a forced drift resync of autobot-slm-frontend deletes the live bundle and its rollback (dist-*, current, previous are not excluded) #16717

Problem

A forced "Resync from source" on autobot-slm-frontend deletes the bundle the SLM is serving and its rollback, and nothing replaces them until a rebuild succeeds.

Verified on origin/main (7b49b52):

• POST /code-sync/drift/resolve runs a delete-style rsync (api/code_sync.py, _rsync_local_cmd, CRITICAL(deploy): drift checker reports 3 false-positive stale components — resolving them would remove 34 plugin files and the audit logs #13851) from the component's source to its deployed directory.
• The only paths it keeps are the component's own excludes plus HOST_STATE_EXCLUDES (services/deploy_artifacts.py:69). autobot-slm-frontend's excludes in _SLM_COMPONENTS are [], and HOST_STATE_EXCLUDES covers none of the frontend's release artifacts.
• The deletion guard (_drift_resolve_check_deletion_guard, CRITICAL(deploy): drift checker reports 3 false-positive stale components — resolving them would remove 34 plugin files and the audit logs #13851) refuses by default, but it returns early on request.force.
• The SLM frontend is published as staged releases (roles/_shared/tasks/build_publish_slm_frontend.yml, slm_frontend_release_keep: 3). Each build is a dist-<build id>/ directory, with current and previous symlinks. nginx serves root {{ slm_frontend_dir }}/current; (roles/slm_manager/templates/autobot-slm.conf.j2:78).
• None of dist-*, current, previous or the legacy dist is tracked in source. A forced resync therefore deletes all of them, including the live bundle current points at and the rollback previous points at. The SLM UI, which is the page used to trigger the resync, then returns errors until the post-sync rebuild completes. If that build fails, there is no earlier bundle left to fall back to.

Observed on 2026-09-14: the drift page lists 264 files from the three retained builds as "untracked … left over. Resync from source would delete these." That is wrong for these paths. They are release artifacts that retention keeps on purpose, not leftovers.

Not affected: the #16351 deleted-files step. Its candidates come from git history, so paths git never tracked are never deleted. autobot-frontend does not use this layout.

Acceptance criteria

• A resync of autobot-slm-frontend, forced or not, never removes dist-*, current, previous or dist. The patterns come from the build module's own vocabulary (services/slm_frontend_build.py _BUILD_PREFIX and the symlink names), not a restated literal. Tested with a forced resync against a fixture tree that has live current/previous targets.
• The drift walk classifies these paths as release artifacts (host state), not as "untracked … left over", so the page stops saying resync would delete them.
• A guard test fails if any component with a staged-release layout has a resync exclude set that does not cover it.