fix(jenkins): avoid rawBuild in deploy gate

jenkins/Jenkinsfile.deploy

@@ -22,12 +22,14 @@ pipeline {
 
       steps {
         script {
-          def upstreamCause = currentBuild.rawBuild.getCause(hudson.model.Cause$UpstreamCause)
-          if (upstreamCause == null) {
+          // 使用 RunWrapper 白名单方法读取触发原因，避免触发 Jenkins Script Security 审批。
+          def upstreamCauses = currentBuild.getBuildCauses('hudson.model.Cause$UpstreamCause')
+          if (!upstreamCauses || upstreamCauses.isEmpty()) {
             error('部署流水线禁止人工直接执行，只允许由上游构建并部署流水线触发。')
           }
 
-          def actualUpstreamJob = upstreamCause.upstreamProject ?: ''
+          def upstreamCause = upstreamCauses[0]
+          def actualUpstreamJob = upstreamCause?.upstreamProject ?: ''
           def expectedUpstreamJob = params.EXPECTED_UPSTREAM_JOB?.trim()
           def allowedUpstreamJob = env.GENARRATIVE_ALLOWED_UPSTREAM_JOB?.trim()