加固既有生产部署流程（07-27-yang-jun-reimbursement-readiness）

deploy/trialrun/deploy.sh

@@ -21,6 +21,7 @@ ENV_CONTRACT_SCRIPT="deploy/trialrun/validate-env-contract.js"
 RUNTIME_SMOKE_SCRIPT="server/src/scripts/smoke-trialrun-runtime.js"
 EXTERNAL_DEPS_SMOKE_SCRIPT="server/src/scripts/smoke-external-deps.js"
 PROVENANCE_SCRIPT="deploy/trialrun/check-source-provenance.mjs"
+REMOTE_PREFLIGHT_SCRIPT="deploy/trialrun/preflight-remote.sh"
 STAGING_DIR=""
 RSYNC_PROTECT_ARGS=()
 
@@ -148,6 +149,11 @@ if [[ ! -f "${ROOT_DIR}/${EXTERNAL_DEPS_SMOKE_SCRIPT}" ]]; then
   exit 1
 fi
 
+if [[ ! -f "${ROOT_DIR}/${REMOTE_PREFLIGHT_SCRIPT}" ]]; then
+  echo "[ERROR] 缺少 ${REMOTE_PREFLIGHT_SCRIPT}" >&2
+  exit 1
+fi
+
 if [[ "${SYNC_ENV}" == "1" && ! -f "${ROOT_DIR}/${LOCAL_ENV_FILE}" ]]; then
   echo "[ERROR] SYNC_ENV=1 但本地不存在 ${LOCAL_ENV_FILE}" >&2
   exit 1
@@ -160,7 +166,12 @@ echo ">>> 2. 从已验证提交生成不可变同步目录"
 STAGING_DIR="$(mktemp -d "${TMPDIR:-/tmp}/hyb-oa-deploy.XXXXXX")"
 git -C "$ROOT_DIR" archive --format=tar "$SOURCE_COMMIT" | tar -xf - -C "$STAGING_DIR"
 
-echo ">>> 3. 创建远端目录"
+echo ">>> 3. 同步前只读校验远端部署合同"
+ssh "${DEPLOY_SERVER}" \
+  "REMOTE_DIR='${REMOTE_DIR}' REMOTE_ENV_FILE='${REMOTE_ENV_FILE}' COMPOSE_FILE='${COMPOSE_FILE}' POSTGRES_DATA_DIR='${POSTGRES_DATA_DIR}' STORAGE_HOST_DIR='${STORAGE_HOST_DIR}' DEPLOY_DATA_MODE='${DEPLOY_DATA_MODE}' SYNC_ENV='${SYNC_ENV}' bash -s" \
+  < "${ROOT_DIR}/${REMOTE_PREFLIGHT_SCRIPT}"
+
+echo ">>> 3.1 创建远端目录"
 ssh "${DEPLOY_SERVER}" "mkdir -p '${REMOTE_DIR}'"
 
 echo ">>> 4. 同步已验证提交到服务器"