An undo button for hosting that has none

The client won't leave their hosting. Fine. You build on your box and treat their host as a folder: one POST registers it as an FTP backend, and it mounts into the build container. Deploying is copying the build tree out.

But their hosting has no undo: no versions, no rollback, one FTP password between the site and oblivion. So the undo lives on your side: before every release, a snapshot.

When Thursday's deploy breaks their contact form, you don't reconstruct anything. You boot a copy from Wednesday's snapshot, copy its tree back out through the same mount, and the site is Wednesday again.

They kept their hosting. You keep the undo for a host that has none.