Fix release asset deployment

Package built frontend assets in wheels and force clean upgrades.

Run API-triggered updates in a transient unit with a safe delay.

deploy/repo-upgrade.sh

@@ -49,18 +49,23 @@ if ! git rev-parse --verify --quiet "refs/tags/$RELEASE_TAG" >/dev/null; then
 fi
 git checkout --detach "$RELEASE_TAG"
 test "$(git describe --tags --exact-match HEAD)" = "$RELEASE_TAG"
-"$VENV/bin/pip" install --upgrade "$REPO_DIR"
+"$VENV/bin/pip" install --upgrade --force-reinstall --no-cache-dir "$REPO_DIR"
 install -m 0644 "$REPO_DIR/deploy/importarr.service" /etc/systemd/system/importarr.service
 install -m 0755 "$REPO_DIR/deploy/repo-upgrade.sh" "$PREFIX/repo-upgrade.sh"
 systemctl daemon-reload
 GIT_SHA="$(git rev-parse --short=12 HEAD 2>/dev/null || printf development)"
 BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
 VERSION="$RELEASE_TAG"
-cat > "$PREFIX/build.env" <<EOF
+BUILD_ENV_TMP="$PREFIX/build.env.tmp.$$"
+trap 'rm -f "$BUILD_ENV_TMP"' EXIT HUP INT TERM
+cat > "$BUILD_ENV_TMP" <<EOF
 IMPORTARR_VERSION=$VERSION
 IMPORTARR_GIT_SHA=$GIT_SHA
 IMPORTARR_BUILD_DATE=$BUILD_DATE
 EOF
+chmod 0644 "$BUILD_ENV_TMP"
+mv -f "$BUILD_ENV_TMP" "$PREFIX/build.env"
+trap - EXIT HUP INT TERM
 systemctl restart "$SERVICE"
 systemctl restart manual-media-import.timer
 systemctl --no-pager --full status "$SERVICE"