接入发布候选回执强制校验（09-06-release-gate-integrity）

deploy/trialrun/production-identity-bootstrap.mjs

@@ -7,6 +7,7 @@ import path from "node:path";
 import process from "node:process";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { deploymentReadOnlyMode, requireReleaseReceipt, ReleaseGateError } from "../../scripts/qa/release-gate-result.mjs";
 
 const SCRIPT_DIR = path.dirname(fileURLToPath(import.meta.url));
 const ROOT_DIR = path.resolve(SCRIPT_DIR, "../..");
@@ -198,6 +199,9 @@ function main() {
   try {
     const identityOnly = process.env.PRODUCTION_IDENTITY_ONLY ?? "0";
     if (!["0", "1"].includes(identityOnly)) fail("PRODUCTION_IDENTITY_ONLY_INVALID");
+    const { preflightOnly } = deploymentReadOnlyMode(process.env, true);
+    // Reject before SSH configuration discovery, target probes or database reads.
+    const release = identityOnly === "1" || preflightOnly ? null : requireReleaseReceipt();
     const historicalTargetScript = requiredCommandOutput(
       "git",
       ["show", `${HISTORICAL_TARGET_COMMIT}:${DEPLOY_SCRIPT_AT_COMMIT}`],
@@ -228,11 +232,13 @@ function main() {
     const databaseIdentityHash = bootstrapDatabaseIdentityHash(identity, contract, expectedOrigin);
 
     console.log("[production-identity-bootstrap][PASS] exact_identity_group");
+    if (release) requireReleaseReceipt(release.directory, release.commit);
     const result = spawnSync("bash", [DEPLOY_EXISTING_SCRIPT], {
       cwd: ROOT_DIR,
       stdio: "inherit",
       env: {
         ...process.env,
+        ...(release ? { RELEASE_GATE_RECEIPT_DIR: release.directory, RELEASE_GATE_EXPECTED_COMMIT: release.commit } : {}),
         DEPLOY_SERVER: identity.deployServer,
         DEPLOY_REFRESH_SERVER: refreshTarget,
         EXPECTED_DEPLOY_SERVER: identity.deployServer,
@@ -246,7 +252,7 @@ function main() {
     });
     if (result.status !== 0) fail("DEPLOY_EXISTING_FAILED");
   } catch (error) {
-    const code = error instanceof ProductionIdentityBootstrapError
+    const code = error instanceof ProductionIdentityBootstrapError || error instanceof ReleaseGateError
       ? error.code
       : "PRODUCTION_IDENTITY_BOOTSTRAP_UNEXPECTED_ERROR";
     console.error(`[production-identity-bootstrap][PAUSED] code=${code}`);