feat: refine admin workflows and deployment packaging

docs/deployment-runbook.md

@@ -49,6 +49,38 @@ Optional variables:
 14. Run `npm run smoke -- "$NEXT_PUBLIC_SITE_URL"`.
 15. Log out of the admin, open `/admin/login`, and confirm the verification code is required before password validation.
 
+## Deployment Package
+
+Use `scripts/package-deploy.sh` when a server-ready source and build archive is needed.
+
+```bash
+NEXT_PUBLIC_SITE_URL=https://www.eversolo.com ./scripts/package-deploy.sh
+```
+
+The script runs `npm run build`, creates `deploy-packages/<timestamp>-deploy-nopublic-noenv/eversoloweb-deploy-nopublic-noenv-<timestamp>.tar.gz`, and writes a matching `manifest.txt`.
+
+The archive intentionally excludes:
+
+- `public/`
+- upload/data directories that are deployed separately: `media/`, `files/`, and `videos/`
+- `.env`, `.env.*`, and `.env.example`
+- `node_modules/`
+- `.git/`
+- `deploy-packages/`
+- `.next/cache/` and `.next-dev/`
+- macOS metadata inside the archive, such as `._*`, `.DS_Store`, and `__MACOSX`
+- common local logs, cache folders, test output, and temporary files
+
+On APFS, macOS may still attach `com.apple.provenance` to the outer `.tar.gz` file even after `xattr -c`. The script prints that as a warning, but still fails if Apple metadata appears inside the archive contents.
+
+`NEXT_PUBLIC_SITE_URL` must be the final public origin when the package is built. Do not build a deployment package with `localhost`, because sitemap, robots, canonical URLs, and metadata can be generated from this value.
+
+If the build has already been run with the correct public URL and only the tarball needs to be recreated:
+
+```bash
+NEXT_PUBLIC_SITE_URL=https://www.eversolo.com SKIP_BUILD=1 ./scripts/package-deploy.sh
+```
+
 ## Data Rules
 
 - Do not run `PAYLOAD_DB_PUSH=true` against production.