ci: harden maintenance and api deploy checkout

jenkins/Jenkinsfile.production-api-deploy

@@ -73,12 +73,17 @@ pipeline {
           extensions: [[$class: 'CleanBeforeCheckout']],
           userRemoteConfigs: [[url: "${GIT_REMOTE_URL}"]],
         ])
+        script {
+          if (params.COMMIT_HASH?.trim()) {
+            echo "API 发布脚本 checkout 将忽略上游构建 commit=${params.COMMIT_HASH}，改用 ${params.SOURCE_BRANCH ?: 'master'} 最新提交，避免发布阶段回退到旧部署脚本。构建产物仍由 BUILD_NUMBER_TO_DEPLOY 决定。"
+          }
+        }
         sh '''
           bash -lc '
             set -euo pipefail
             chmod +x scripts/jenkins-checkout-source.sh
             SOURCE_BRANCH="${SOURCE_BRANCH:-master}" \
-            COMMIT_HASH="${COMMIT_HASH:-}" \
+            COMMIT_HASH="" \
             GIT_REMOTE_URL="${GIT_REMOTE_URL}" \
             SOURCE_COMMIT_FILE=".jenkins-source-commit" \
             scripts/jenkins-checkout-source.sh