Продакшн-фиксы install/reconfigure: rollback, firewall lifecycle, preflight и runbook

tools/build/lib/deps.sh

@@ -89,10 +89,13 @@ go_version() {
 
 ensure_go() {
   local managed="$TOOLCHAIN_DIR/go/bin/go"
+  local go_mode=""
   if [ -x "$managed" ] && [ "$(go_version "$managed")" = "$GO_REQUIRED" ]; then
     GO_BIN="$managed"
+    go_mode="managed"
   elif command -v go >/dev/null 2>&1 && [ "$(go_version "$(command -v go)")" = "$GO_REQUIRED" ]; then
     GO_BIN="$(command -v go)"
+    go_mode="global"
   else
     log_info "Installing Go $GO_REQUIRED into $TOOLCHAIN_DIR/go"
     mkdir -p "$TOOLCHAIN_DIR/downloads"
@@ -102,10 +105,15 @@ ensure_go() {
     rm -rf "$TOOLCHAIN_DIR/go"
     tar -C "$TOOLCHAIN_DIR" -xzf "$archive"
     GO_BIN="$managed"
+    go_mode="managed"
   fi
 
   export GO_BIN
-  export GOROOT="$TOOLCHAIN_DIR/go"
+  if [ "$go_mode" = "managed" ]; then
+    export GOROOT="$TOOLCHAIN_DIR/go"
+  else
+    unset GOROOT || true
+  fi
   export PATH="$(dirname "$GO_BIN"):$PATH"
   export GOTOOLCHAIN=local
   [ "$(go_version "$GO_BIN")" = "$GO_REQUIRED" ] || fail "Go version mismatch: required $GO_REQUIRED, got $($GO_BIN version)"