fix(backup): deploy guarded SigNoz backup script

docs/LOGBOOK.md

@@ -8,6 +8,7 @@
 **source/test evidence**：
 - CD probe 改為先檢查 connection budget、保留 4 條安全餘量、最多 4 workers、單輪、每 request 5 秒；新增 workers/reserve/skip reason machine-readable receipt fields。
 - `backup-signoz.sh` 在 stop 前先 arm restore，加入 `EXIT/HUP/INT/TERM` trap、防重入 cleanup 與首次 restart 失敗後的有界 EXIT retry。
+- `110-devops.yml --tags backup_jobs` 納入 `backup-signoz.sh`，確保 source guard 有可驗證的 `/backup/scripts/backup-signoz.sh` 部署路徑，不再只停留在 repo。
 - 新增 `ops/signoz/p0-obs-002-post-closure-regression.yaml`，分離 API probe starvation、collector backup interruption、controlled recovery、source candidate 與 scope boundary。
 
 **仍維持**：

infra/ansible/playbooks/110-devops.yml

@@ -241,6 +241,7 @@
         - backup-momo.sh
         - backup-awoooi.sh
         - backup-awoooi-frequent.sh
+        - backup-signoz.sh
         - backup-configs.sh
         - check-backup-integrity.sh
         - verify-gitea-backup.sh

ops/signoz/p0-obs-002-post-closure-regression.yaml

@@ -66,6 +66,9 @@ source_candidates:
     deployment_status: pending
   backup_restore_guard:
     path: scripts/backup/backup-signoz.sh
+    deployment_playbook: infra/ansible/playbooks/110-devops.yml
+    deployment_tag: backup_jobs
+    deployment_contract_present: true
     trap_exit_hup_int_term: true
     restore_armed_before_stop: true
     bounded_exit_retry: true

scripts/backup/tests/test_backup_signoz_collector_restore.py

@@ -8,6 +8,9 @@ from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[3]
 SCRIPT = ROOT / "scripts" / "backup" / "backup-signoz.sh"
+DEPLOYMENT_PLAYBOOK = (
+    ROOT / "infra" / "ansible" / "playbooks" / "110-devops.yml"
+)
 
 
 def _write_executable(path: Path, text: str) -> None:
@@ -129,6 +132,14 @@ def _collector_start_count(docker_calls: list[str]) -> int:
     return docker_calls.count("start signoz-otel-collector")
 
 
+def test_backup_jobs_deploys_the_guarded_signoz_script() -> None:
+    playbook = DEPLOYMENT_PLAYBOOK.read_text(encoding="utf-8")
+
+    assert 'dest: "/backup/scripts/{{ item }}"' in playbook
+    assert "- backup-signoz.sh" in playbook
+    assert "tags: backup_jobs" in playbook
+
+
 def test_collector_is_restored_once_when_backup_receives_term(tmp_path: Path) -> None:
     result, docker_calls, dump_dir = _run_backup(
         tmp_path,