完善 readiness、发布追溯与敏感治理（07-15-production-trust-closeout-cleanup）

deploy/trialrun/docker-compose.yml

@@ -55,6 +55,9 @@ services:
     build:
       context: ../..
       dockerfile: deploy/trialrun/Dockerfile
+      args:
+        BUILD_SHA: ${BUILD_SHA:?set BUILD_SHA to the approved full commit}
+        VITE_BUILD_SHA: ${VITE_BUILD_SHA:?set VITE_BUILD_SHA to the matching short commit}
     container_name: hyb-oa-trialrun-server
     restart: unless-stopped
     depends_on:
@@ -64,6 +67,7 @@ services:
       - ./.env
     environment:
       NODE_ENV: production
+      BUILD_SHA: ${BUILD_SHA:?set BUILD_SHA to the approved full commit}
     ports:
       - "3000:3000"
     volumes:
@@ -73,6 +77,9 @@ services:
     build:
       context: ../..
       dockerfile: deploy/trialrun/Dockerfile
+      args:
+        BUILD_SHA: ${BUILD_SHA:?set BUILD_SHA to the approved full commit}
+        VITE_BUILD_SHA: ${VITE_BUILD_SHA:?set VITE_BUILD_SHA to the matching short commit}
     container_name: hyb-oa-trialrun-worker
     restart: unless-stopped
     profiles: ["worker"]
@@ -84,6 +91,7 @@ services:
     command: ["npm", "run", "worker"]
     environment:
       NODE_ENV: production
+      BUILD_SHA: ${BUILD_SHA:?set BUILD_SHA to the approved full commit}
       SERVE_CLIENT_DIST: "false"
       JOBS_ENABLED: "true"
     volumes:
@@ -93,6 +101,9 @@ services:
     build:
       context: ../..
       dockerfile: deploy/trialrun/Dockerfile
+      args:
+        BUILD_SHA: ${BUILD_SHA:?set BUILD_SHA to the approved full commit}
+        VITE_BUILD_SHA: ${VITE_BUILD_SHA:?set VITE_BUILD_SHA to the matching short commit}
     container_name: hyb-oa-trialrun-init
     depends_on:
       db:
@@ -101,6 +112,7 @@ services:
       - ./.env
     environment:
       NODE_ENV: production
+      BUILD_SHA: ${BUILD_SHA:?set BUILD_SHA to the approved full commit}
     volumes:
       - ./data/storage:${STORAGE_DIR}
     entrypoint: ["sh", "-c"]