fix(deploy): back up MAM-owned env under --force and restrict deletion to --purge-env

deploy/remove.sh

@@ -118,8 +118,8 @@ delete_asset() {
 if [ ${#manifest_files[@]} -gt 0 ]; then
   echo "📜 Manifest found. Reversing installer-created files..."
   for f in ${manifest_files[@]+"${manifest_files[@]}"}; do
-    # Skip .env and remove.sh for now, they are handled separately
-    if [ "$f" = ".env" ] || [ "$f" = "remove.sh" ]; then
+    # Skip .env, .mam.env, and remove.sh for now, they are handled separately
+    if [ "$f" = ".env" ] || [ "$f" = ".mam.env" ] || [ "$f" = "remove.sh" ]; then
       continue
     fi
     delete_asset "$f"
@@ -146,49 +146,64 @@ delete_asset ".venv"
 delete_asset ".cache/multi-agent-mux-monitor"
 delete_asset ".mam"  # Deletes manifest file too
 
-# 5. Clean up .env file (Only if created by installer, or forced with --purge-env)
-# If .env is in manifest, it means MAM created it.
+# 5. Clean up .env and .mam.env files (Only if created by installer, or forced with --purge-env)
+for env_name in ".mam.env" ".env"; do
+  [ -f "$env_name" ] || continue
+  
   env_created_by_mam=0
   for f in ${manifest_files[@]+"${manifest_files[@]}"}; do
-  if [ "$f" = ".env" ]; then
+    if [ "$f" = "$env_name" ]; then
       env_created_by_mam=1
       break
     fi
   done
 
-if [ -f ".env" ]; then
   should_delete_env=0
   if [ $PURGE_ENV -eq 1 ]; then
     should_delete_env=1
-  elif [ $env_created_by_mam -eq 1 ]; then
-    # Even if MAM created it, ask or rename to backup to prevent loss of custom secrets
-    if [ $FORCE -eq 1 ]; then
-      should_delete_env=1
-    else
-      if ! read -p "❓ MAM-created '.env' found. Delete it? (Saying No preserves it) [y/N]: " -r env_response; then
+  elif [ $env_created_by_mam -eq 1 ] && [ $FORCE -eq 0 ]; then
+    if ! read -p "❓ MAM-created '$env_name' found. Delete it? (Saying No preserves it) [y/N]: " -r env_response; then
       env_response="n"
     fi
     if [[ "$env_response" =~ ^[yY](es)?$ ]]; then
       should_delete_env=1
     fi
   fi
-  fi
 
   if [ $should_delete_env -eq 1 ]; then
-    delete_asset ".env"
+    delete_asset "$env_name"
   else
     if [ $env_created_by_mam -eq 1 ]; then
-      backup_name=".env.mam-backup"
-      if [ -e "$backup_name" ]; then
-        backup_name=".env.mam-backup.$(date +%Y%m%d%H%M%S)"
+      already_preserved=0
+      for existing in "${env_name}.mam-backup" "${env_name}".mam-backup.*; do
+        [ -f "$existing" ] || continue
+        if cmp -s "$env_name" "$existing" 2>/dev/null; then
+          already_preserved=1
+          rm -f "$env_name"
+          echo "ℹ️  '$env_name' is already preserved in $existing (no duplicate created)."
+          break
+        fi
+      done
+
+      if [ $already_preserved -eq 0 ]; then
+        slot="${env_name}.mam-backup"
+        if [ -e "$slot" ]; then
+          slot="${env_name}.mam-backup.$(date +%Y%m%d%H%M%S)"
+          n=1
+          while [ -e "$slot" ]; do
+            slot="${env_name}.mam-backup.$(date +%Y%m%d%H%M%S)-$n"
+            n=$((n + 1))
+          done
+        fi
+        mv "$env_name" "$slot"
+        echo "💾 Backed up $env_name -> $slot"
+        echo "   To remove the configuration entirely, re-run with --purge-env."
       fi
-      echo "💾 Backing up .env configuration to $backup_name..."
-      mv ".env" "$backup_name"
     else
-      echo "ℹ️  Preserving user-owned .env configuration."
-    fi
+      echo "ℹ️  Preserving user-owned $env_name configuration."
     fi
   fi
+done
 
 # 6. Remove uninstaller file itself (if we are in the target root)
 # Simple check: only delete remove.sh if it is recorded in the manifest