修正 SpacetimeDB 2.8.3 生产配置

更新 Jenkins Server-Provision 的 SpacetimeDB 下载根与 CLI commit 默认值

同步容器部署文档中的 SpacetimeDB 版本说明

补充生产运维门禁，防止 Jenkins 版本配置回退

scripts/check-production-ops-guardrails.mjs

@@ -899,6 +899,46 @@ const checks = [
     reason:
       'Server-Provision Job 必须允许 dev/release 为 files-history 选择各自的 baseline state 目录。',
   },
+  {
+    file: 'jenkins/Jenkinsfile.production-server-provision',
+    includes:
+      "string(name: 'SPACETIME_DOWNLOAD_ROOT', defaultValue: 'https://github.com/clockworklabs/SpacetimeDB/releases/download/v2.8.3'",
+    reason:
+      'Server-Provision Job 的 SpacetimeDB 下载根必须与 workspace 锁定的 2.8.3 版本一致。',
+  },
+  {
+    file: 'jenkins/Jenkinsfile.production-server-provision',
+    includes:
+      "string(name: 'SPACETIME_EXPECTED_COMMIT', defaultValue: '8e410d2842147bd8e5a32a9589cc00c19f7478e2'",
+    reason:
+      'Server-Provision Job 必须锁定 SpacetimeDB 2.8.3 的 CLI commit，拒绝同版本号但构建来源不一致的二进制。',
+  },
+  {
+    file: 'jenkins/Jenkinsfile.production-server-provision',
+    includes:
+      'SPACETIME_DOWNLOAD_ROOT="${SPACETIME_DOWNLOAD_ROOT:-https://github.com/clockworklabs/SpacetimeDB/releases/download/v2.8.3}"',
+    reason:
+      'Server-Provision 执行阶段的 SpacetimeDB 下载根默认值必须与 Job 参数默认值一致。',
+  },
+  {
+    file: 'jenkins/Jenkinsfile.production-server-provision',
+    includes:
+      'SPACETIME_EXPECTED_COMMIT="${SPACETIME_EXPECTED_COMMIT:-8e410d2842147bd8e5a32a9589cc00c19f7478e2}"',
+    reason:
+      'Server-Provision 执行阶段的 SpacetimeDB commit 默认值必须与 Job 参数默认值一致。',
+  },
+  {
+    file: 'jenkins/Jenkinsfile.production-server-provision',
+    excludes: 'v2.7.0-hotfix3',
+    reason:
+      'Server-Provision 不得保留已退役的 SpacetimeDB 2.7.0 hotfix 资产标签。',
+  },
+  {
+    file: 'jenkins/Jenkinsfile.production-server-provision',
+    excludes: 'd220349adb7af7eefa810eb08a185609356b83f6',
+    reason:
+      'Server-Provision 不得保留 SpacetimeDB 2.7.0 的旧 CLI commit 门禁。',
+  },
   {
     file: 'jenkins/Jenkinsfile.production-server-provision',
     excludes: