fix(ci): simplify server provision pipeline

scripts/jenkins-prepare-cargo-env.sh

@@ -28,7 +28,7 @@ if [[ -z "${RUSTUP_HOME:-}" && -n "${ORIGINAL_HOME}" && -d "${ORIGINAL_HOME}/.ru
 fi
 
 # HOME 会在下面切到组件级缓存目录，因此这里先把真实用户的 Rust 工具链目录补进 PATH。
-# Server-Provision 通过 cargo install 安装的 sccache 通常会落在 /root/.cargo/bin。
+# Jenkins 构建节点预装的 Rust 工具和 sccache 通常会落在 /root/.cargo/bin。
 for tool_dir in "${ORIGINAL_HOME}/.cargo/bin" /root/.cargo/bin /usr/local/cargo/bin; do
   if [[ -d "${tool_dir}" && ":${PATH}:" != *":${tool_dir}:"* ]]; then
     export PATH="${tool_dir}:${PATH}"

scripts/jenkins-server-provision.sh

@@ -56,6 +56,18 @@ run_cmd() {
   fi
 }
 
+require_root_for_real_provision() {
+  if [[ "${DRY_RUN}" == "true" ]]; then
+    return
+  fi
+
+  if [[ "$(id -u)" != "0" ]]; then
+    echo "[server-provision] 非 dry-run 会安装系统包、写入 systemd/Nginx 和创建系统用户，必须在 root agent 上执行。" >&2
+    echo "[server-provision] 当前用户: $(id -un) uid=$(id -u)。请确认 DEPLOY_TARGET=${DEPLOY_TARGET:-} 对应的目标服务器 agent 以 root 运行，或保持 DRY_RUN=true。" >&2
+    exit 1
+  fi
+}
+
 install_file() {
   local source="$1"
   local target="$2"
@@ -66,21 +78,6 @@ install_file() {
   fi
 }
 
-install_build_dependencies() {
-  echo "[server-provision] 安装 Linux 构建依赖: clang, lld, pkg-config, OpenSSL headers"
-  if command -v apt-get >/dev/null 2>&1; then
-    run_cmd apt-get update
-    run_cmd apt-get install -y clang lld pkg-config libssl-dev ca-certificates
-  elif command -v dnf >/dev/null 2>&1; then
-    run_cmd dnf install -y clang lld pkgconf-pkg-config openssl-devel ca-certificates
-  elif command -v yum >/dev/null 2>&1; then
-    run_cmd yum install -y clang lld pkgconf-pkg-config openssl-devel ca-certificates
-  else
-    echo "[server-provision] 未找到 apt-get/dnf/yum，无法自动安装 clang/lld。请手动安装后重跑构建。" >&2
-    exit 1
-  fi
-}
-
 install_nginx_brotli_modules() {
   echo "[server-provision] 安装 Nginx Brotli 动态模块依赖"
   if command -v apt-get >/dev/null 2>&1; then
@@ -90,41 +87,6 @@ install_nginx_brotli_modules() {
   fi
 }
 
-install_sccache() {
-  for tool_dir in "${HOME:-}/.cargo/bin" /root/.cargo/bin /usr/local/cargo/bin; do
-    if [[ -d "${tool_dir}" && ":${PATH}:" != *":${tool_dir}:"* ]]; then
-      export PATH="${tool_dir}:${PATH}"
-    fi
-  done
-
-  if command -v sccache >/dev/null 2>&1; then
-    echo "[server-provision] sccache 已存在: $(command -v sccache)"
-    return
-  fi
-
-  if [[ -x /root/.cargo/bin/sccache ]]; then
-    echo "[server-provision] sccache 已存在: /root/.cargo/bin/sccache"
-    return
-  fi
-
-  echo "[server-provision] 未找到 sccache，准备通过 cargo install sccache 安装。"
-  if [[ "${DRY_RUN}" == "true" ]]; then
-    echo "+ cargo install sccache --locked"
-    return
-  fi
-
-  if ! command -v cargo >/dev/null 2>&1; then
-    echo "[server-provision] 未找到 cargo，无法自动安装 sccache。请先安装 Rust 工具链后重跑 Server-Provision。" >&2
-    exit 1
-  fi
-
-  cargo install sccache --locked
-  if ! command -v sccache >/dev/null 2>&1 && [[ ! -x /root/.cargo/bin/sccache ]]; then
-    echo "[server-provision] sccache 安装后仍不可用，请检查 cargo bin 目录是否在 PATH 中。" >&2
-    exit 1
-  fi
-}
-
 sync_otelcol_install() {
   local target_bin="/usr/local/bin/otelcol-contrib"
   local source_bin="${OTELCOL_BIN_SOURCE}"
@@ -142,7 +104,7 @@ sync_otelcol_install() {
 
   if [[ ! -x "${resolved_source}" ]]; then
     echo "[server-provision] otelcol-contrib 不存在或不可执行: ${source_bin}" >&2
-    echo "[server-provision] 请先在构建机准备好 otelcol-contrib ${version}，再通过 provision-tools 上传到目标机。" >&2
+    echo "[server-provision] 请确认 Prepare Provision Tools 已在目标 agent 生成 otelcol-contrib ${version}: ${source_bin}" >&2
     exit 1
   fi
 
@@ -671,9 +633,8 @@ require_non_root_relative_path "PROVISION_TOOLS_DIR" "${PROVISION_TOOLS_DIR}"
 echo "[server-provision] target=${DEPLOY_TARGET}, dry_run=${DRY_RUN}, nginx_config_mode=${NGINX_CONFIG_MODE}, source_commit=$(cat .jenkins-source-commit)"
 
 run_cmd id
-install_build_dependencies
+require_root_for_real_provision
 install_nginx_brotli_modules
-install_sccache
 run_cmd mkdir -p "${SPACETIME_ROOT}" "${RELEASE_ROOT}" "$(dirname "${CURRENT_LINK}")" "$(dirname "${WEB_LINK}")" /etc/genarrative /var/lib/genarrative/maintenance /var/lib/genarrative/auth /var/lib/genarrative/tracking-outbox /var/lib/genarrative/database-backups
 
 if ! id spacetimedb >/dev/null 2>&1; then