接入发布候选回执强制校验（09-06-release-gate-integrity）

scripts/qa/run-release-gate.sh

@@ -2,6 +2,7 @@
 set -euo pipefail
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT_DIR"
 ARTIFACT_ROOT="${RELEASE_GATE_ARTIFACT_DIR:-${ROOT_DIR}/artifacts/release-gate/$(date +%Y%m%d-%H%M%S)}"
 MODE="${1:-all}"
 CURRENT_STAGE=""
@@ -16,13 +17,14 @@ Usage: bash scripts/qa/run-release-gate.sh <verify-candidate|all|static|smoke-lo
   smoke-local  运行本地网页 smoke 门禁
   full-local   运行本地全量门禁（server regression + client full E2E）
   project-wide 项目级门禁：static + 覆盖扫描 + UI/移动契约 + 迁移漂移诊断 + 业务流 + 全页面视觉 + live readiness
-  deploy       调用 deploy/trialrun/deploy.sh，内部会串联 /ready、external deps、runtime smoke 与 live smoke
-  all          依次执行 static -> smoke-local -> full-local -> deploy
-  ci-release   依次执行 static -> full-local -> deploy
+  deploy       只消费显式回执，经生产身份引导器发布；不隐式运行测试
+  all          smoke-local -> 单次 verify-candidate（或重验显式回执）-> 生产发布链
+  ci-release   单次 verify-candidate（或重验显式回执）-> 生产发布链
   r66-trialrun  R66 小团队试点门禁：static -> server regression-all -> smoke-local
 
 可选环境变量：
   RELEASE_GATE_ARTIFACT_DIR   失败产物输出目录
+  RELEASE_GATE_RECEIPT_DIR    显式消费的完整候选回执目录；不自动选择历史回执
   QA_*                        透传给 scripts/qa/run-web-gates.sh
   LIVE_SMOKE_*                透传给 deploy.sh 与 live smoke
   PROJECT_WIDE_SKIP_BUSINESS_FLOW=1  跳过业务流 E2E
@@ -45,7 +47,11 @@ collect_failure_artifacts() {
 handle_error() {
   local exit_code="$?"
   echo "[release-gate][FAIL] 阶段 ${CURRENT_STAGE:-unknown} 失败（exit=${exit_code}）" >&2
-  collect_failure_artifacts
+  # Rejected publication must not trigger diagnostic reads of real configuration.
+  case "$MODE" in
+    ci-release|all|deploy) ;;
+    *) collect_failure_artifacts ;;
+  esac
   exit "$exit_code"
 }
 trap handle_error ERR
@@ -129,10 +135,21 @@ stage_project_wide_live_readiness() {
 }
 
 stage_deploy() {
-  bash "$ROOT_DIR/deploy/trialrun/deploy.sh"
+  RELEASE_GATE_EXPECTED_COMMIT="$(node "$ROOT_DIR/scripts/qa/release-gate-result.mjs" require "${RELEASE_GATE_RECEIPT_DIR:-}")"
+  export RELEASE_GATE_EXPECTED_COMMIT
+  node "$ROOT_DIR/deploy/trialrun/production-identity-bootstrap.mjs"
 }
 
-# This entry does not install enforcement in any existing deployment path.
+prepare_release_receipt() {
+  if [[ -z "${RELEASE_GATE_RECEIPT_DIR+x}" ]]; then
+    # This verification-only child cannot call back into the deployment chain.
+    RELEASE_GATE_ARTIFACT_DIR="$ARTIFACT_ROOT" bash "$ROOT_DIR/scripts/qa/run-release-gate.sh" verify-candidate
+    RELEASE_GATE_RECEIPT_DIR="$ARTIFACT_ROOT"
+    export RELEASE_GATE_RECEIPT_DIR
+  fi
+}
+
+# The verification-only mode records its own original exit and never deploys.
 finish_candidate() {
   local original_status=$? receipt_status=0
   trap - EXIT ERR INT TERM
@@ -145,6 +162,16 @@ if [[ "$MODE" != "help" && "$MODE" != "-h" && "$MODE" != "--help" ]]; then
   # Validate before static, remote readiness or deployment side effects.
   trap - ERR
   node "$ROOT_DIR/scripts/qa/release-gate-result.mjs" skip "$ARTIFACT_ROOT" "$MODE"
+  case "$MODE" in
+    ci-release|all|deploy)
+      node "$ROOT_DIR/scripts/qa/release-gate-result.mjs" write-mode
+      # Invalid explicit receipts fail before smoke or other side effects.
+      if [[ -n "${RELEASE_GATE_RECEIPT_DIR+x}" || "$MODE" == "deploy" ]]; then
+        RELEASE_GATE_EXPECTED_COMMIT="$(node "$ROOT_DIR/scripts/qa/release-gate-result.mjs" require "${RELEASE_GATE_RECEIPT_DIR:-}")"
+        export RELEASE_GATE_EXPECTED_COMMIT
+      fi
+      ;;
+  esac
   if [[ "$MODE" != "verify-candidate" ]]; then trap handle_error ERR; fi
 fi
 
@@ -186,8 +213,7 @@ case "$MODE" in
     run_stage deploy stage_deploy
     ;;
   ci-release)
-    run_stage static stage_static
-    run_stage full-local stage_full_local
+    prepare_release_receipt
     run_stage deploy stage_deploy
     ;;
   r66-trialrun)
@@ -196,9 +222,8 @@ case "$MODE" in
     run_stage smoke-local stage_smoke_local
     ;;
   all)
-    run_stage static stage_static
     run_stage smoke-local stage_smoke_local
-    run_stage full-local stage_full_local
+    prepare_release_receipt
     run_stage deploy stage_deploy
     ;;
   *)