接入发布候选回执强制校验（09-06-release-gate-integrity）

deploy/trialrun/deploy-existing.sh

@@ -29,6 +29,19 @@ if [[ "${DEPLOY_ALLOW_UNPUBLISHED_COMMIT:-0}" == "1" || -n "${DEPLOY_UNPUBLISHED
   fail "生产部署验证不接受未进入上游的提交；灾备 override 必须走独立获批流程"
 fi
 
+case "${PRODUCTION_IDENTITY_ONLY-0}" in
+  0) ;;
+  *) fail "identity-only 必须使用生产身份引导器，不能进入发布包装器" ;;
+esac
+case "${PRODUCTION_READ_ONLY_PREFLIGHT-0}" in
+  0)
+    RELEASE_GATE_EXPECTED_COMMIT="$(node "$ROOT_DIR/scripts/qa/release-gate-result.mjs" require "${RELEASE_GATE_RECEIPT_DIR:-}")"
+    export RELEASE_GATE_EXPECTED_COMMIT
+    ;;
+  1) ;;
+  *) fail "PRODUCTION_READ_ONLY_PREFLIGHT 只能为 0 或 1" ;;
+esac
+
 declare -A contract=()
 echo "[deploy-existing] 开始只读聚合体检"
 DEPLOY_SERVER="$DEPLOY_SERVER" \
@@ -60,7 +73,7 @@ fi
 if [[ -z "${EXPECTED_COMPOSE_PROJECT_NAME:-}" ]]; then
   fail "生产部署必须由身份引导器提供 EXPECTED_COMPOSE_PROJECT_NAME"
 fi
-case "${PRODUCTION_READ_ONLY_PREFLIGHT:-0}" in
+case "${PRODUCTION_READ_ONLY_PREFLIGHT-0}" in
   0|1) ;;
   *) fail "PRODUCTION_READ_ONLY_PREFLIGHT 只能为 0 或 1" ;;
 esac
@@ -99,6 +112,8 @@ if [[ "${PRODUCTION_READ_ONLY_PREFLIGHT:-0}" == "1" ]]; then
   exit 0
 fi
 
+node "$ROOT_DIR/scripts/qa/release-gate-result.mjs" require "${RELEASE_GATE_RECEIPT_DIR:-}" "$source_commit" >/dev/null
+
 DEPLOY_SERVER="$DEPLOY_SERVER" \
 REMOTE_DIR="${contract[REMOTE_DIR]}" \
 REMOTE_ENV_FILE="${contract[REMOTE_ENV_FILE]}" \