fix(ci): mv legacy submodule paths aside instead of rm -rf

The previous rm -rf failed with permission denied on root-owned files
inside eafw_geomanager_web/ (a leftover from the pre-Apr-1 monorepo
layout that still contained shadow copies of LandScan, ASAP rasters,
return-period tiffs and google-credentials.json).

Renaming a directory only requires write+exec on the *parent*, not on
the directory's children, so mv works regardless of who owns the files
inside. This:
- Preserves the legacy data untouched in <name>.legacy.<timestamp>
- Frees the path for git submodule update --init to clone fresh
- Lets the operator inspect or delete the .legacy backups manually,
  using docker root if needed, after a successful deploy

Idempotent: once submodules are checked out, the (! -e $sub/.git)
guard is false and the mv is skipped on subsequent deploys.

Author: HillaryKoros

.github/workflows/deploy-staging.yml

@@ -326,14 +326,17 @@ jobs:
               cd $REPO_DIR
             fi
 
-            # One-time cleanup: legacy tracked directories from before the
+            # One-time aside: legacy tracked directories from before the
             # submodule split linger on disk after a git reset --hard, blocking
-            # the fresh submodule clone. Remove anything that isn't already a
-            # git checkout itself.
+            # the fresh submodule clone. Move (don't delete) anything that
+            # isn't already a git checkout. Renaming the directory only needs
+            # write access on the *parent*, so root-owned children inside the
+            # legacy dir are preserved untouched in the .legacy backup.
+            TS=$(date +%Y%m%d_%H%M%S)
             for sub in eafw_geomanager eafw_geomanager_web eafw_geomapviewer eafw_georeport; do
               if [ -d "$sub" ] && [ ! -e "$sub/.git" ]; then
-                rm -rf "$sub"
-                echo "  cleaned stale legacy directory: $sub"
+                mv "$sub" "${sub}.legacy.${TS}"
+                echo "  moved aside: $sub -> ${sub}.legacy.${TS}"
               fi
             done