补齐 Pingora TLS 证书同步

新增 Pingora TLS 证书同步脚本，默认 dry-run，apply 时原子复制证书到私有目录并复核服务用户可读。

将证书同步脚本纳入 API release 构建、部署复制和 current release 自审清单。

补充发布包、deploy、自审和脚本自身门禁，覆盖缺失脚本、symlink 目标与权限边界。

更新 Pingora env 示例、运维文档和项目踩坑记录，明确不要放宽 Let’s Encrypt 原路径权限。

package.json

@@ -44,6 +44,7 @@
     "check:pingora-direct-enable": "node scripts/check-pingora-direct-enable.mjs",
     "check:pingora-direct-rollback": "node scripts/check-pingora-direct-rollback.mjs",
     "check:pingora-health-patrol-env-switch": "node scripts/check-pingora-health-patrol-env-switch.mjs",
+    "check:pingora-tls-cert-sync": "node scripts/check-pingora-tls-cert-sync.mjs",
     "check:pingora-current-release-audit": "node scripts/check-pingora-current-release-audit.mjs",
     "check:pingora-cutover-status-snapshot": "node scripts/check-pingora-cutover-status-snapshot.mjs",
     "check:pingora-cutover-evidence-bundle": "node scripts/check-pingora-cutover-evidence-bundle.mjs",