fix: guard static asset deploy permissions

docs/guides/deployment_sop.md

@@ -19,6 +19,19 @@ scp -o ProxyJump=wooo@192.168.0.110 app.py ollama@192.168.0.188:/home/ollama/mom
 scp -o ProxyJump=wooo@192.168.0.110 -r services/ ollama@192.168.0.188:/home/ollama/momo-pro/
 ```
 
+若使用 tar 打包差異檔，必須用 Git 物件建立部署包，避免 macOS / iCloud 工作目錄的 `600` 權限或 extended attributes 被帶到正式機，造成 `/static/*` 500：
+```bash
+BASE=<上一個已部署 commit>
+HEAD=$(git rev-parse HEAD)
+git diff --name-only "$BASE..$HEAD" > /tmp/momo-deploy-filelist.txt
+git archive --format=tar.gz -o /tmp/momo-deploy-files.tar.gz "$HEAD" $(cat /tmp/momo-deploy-filelist.txt)
+```
+
+部署前本地必跑靜態檔可讀檢查：
+```bash
+.venv/bin/python -m pytest tests/test_frontend_v2_assets.py
+```
+
 若部署時在 110 → 188 的內層 `scp` 遇到 `Host key verification failed`，先在 110 修正 `known_hosts`，不要用 `StrictHostKeyChecking=no` 硬跳過：
 ```bash
 ssh wooo@192.168.0.110 \