加固生产运维定时器绑定（07-26-internal-ops-recovery-baseline）

deploy/trialrun/validate-env-contract.js

@@ -241,6 +241,37 @@ for (const [name, content] of [
   if (!content.includes('-p "$COMPOSE_PROJECT_NAME"')) {
     errors.push(`${name} 必须向 Compose 显式传入独立 project name`);
   }
+  if (!content.includes('"$value" == *"//"*')
+    || !content.includes('"/$value/" == *"/../"*')
+    || !content.includes('"/$value/" == *"/./"*')) {
+    errors.push(`${name} 缺少绝对数据路径的空段与点路径段门禁`);
+  }
+  if (content.includes('[[:space:]]*)($|/)')) {
+    errors.push(`${name} 不得以可匹配空字符串的路径段正则拒绝全部绝对路径`);
+  }
+}
+
+for (const requiredFragment of [
+  'POSTGRES_DATA_DIR="${POSTGRES_DATA_DIR:-}"',
+  'STORAGE_HOST_DIR="${STORAGE_HOST_DIR:-}"',
+  'BUILD_SHA="${BUILD_SHA:-}"',
+  'VITE_BUILD_SHA="${VITE_BUILD_SHA:-}"',
+  'validate_data_path POSTGRES_DATA_DIR "$POSTGRES_DATA_DIR"',
+  'validate_data_path STORAGE_HOST_DIR "$STORAGE_HOST_DIR"',
+  '"$POSTGRES_DATA_DIR" == "$STORAGE_HOST_DIR"/*',
+  '"$STORAGE_HOST_DIR" == "$POSTGRES_DATA_DIR"/*',
+  '"$POSTGRES_DATA_DIR/PG_VERSION"',
+  '"$BUILD_SHA" =~ ^[0-9a-fA-F]{40,64}$',
+  '"$VITE_BUILD_SHA" =~ ^[0-9a-f]{12}$',
+  '"${BUILD_SHA:0:12}" != "$VITE_BUILD_SHA"',
+  'Environment=POSTGRES_DATA_DIR=${POSTGRES_DATA_DIR}',
+  'Environment=STORAGE_HOST_DIR=${STORAGE_HOST_DIR}',
+  'Environment=BUILD_SHA=${BUILD_SHA}',
+  'Environment=VITE_BUILD_SHA=${VITE_BUILD_SHA}',
+]) {
+  if (!timerScriptContent.includes(requiredFragment)) {
+    errors.push(`install-warch3-ops-timer.sh 缺少活动部署环境绑定: ${requiredFragment}`);
+  }
 }
 
 for (const requiredFragment of [