合并最新 master 分支

带入 SpacetimeDB 2.7.0（hotfix3）工具链升级、后台灰度发布控制面恢复、
精选顺序分列瀑布流及后台素材预览统一。冲突仅三处文档：decision-log 与
pitfalls 双方条目并存，运维文档更新时间取新值。BgFilter 分支代码与部署
脚本零冲突；依赖升级后 bgfilter 46 测试全过。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/dev.test.ts

@@ -33,6 +33,7 @@ import {
   normalizeCargoVersionRequirement,
   parseArgs,
   parseProcessEnvBlock,
+  parseSpacetimeToolCommit,
   parseSpacetimeToolVersion,
   resolveDevStackStatePath,
   resolveLocalSpacetimeApiIdentityPath,
@@ -737,7 +738,7 @@ describe('dev scheduler spacetime reuse guard', () => {
       writeFileSync(join(tempDir, 'spacetime.pid'), `${process.pid}\n`, 'utf8');
       writeFileSync(
         join(tempDir, 'dev-spacetime-tool-version'),
-        `${workspaceSpacetimeVersionForTest()}\n`,
+        `${workspaceSpacetimeVersionForTest()}\nd220349adb7af7eefa810eb08a185609356b83f6\n`,
         'utf8',
       );
       globalThis.fetch = vi.fn(async () => ({
@@ -766,7 +767,7 @@ describe('dev scheduler spacetime reuse guard', () => {
       writeFileSync(join(tempDir, 'spacetime.pid'), `${process.pid}\n`, 'utf8');
       writeFileSync(
         join(tempDir, 'dev-spacetime-tool-version'),
-        `${workspaceSpacetimeVersionForTest()}\n`,
+        `${workspaceSpacetimeVersionForTest()}\nd220349adb7af7eefa810eb08a185609356b83f6\n`,
         'utf8',
       );
       globalThis.fetch = vi.fn(async () => ({
@@ -877,12 +878,34 @@ describe('dev scheduler spacetime refresh', () => {
   });
 
   test('解析 spacetime --version 输出里的 tool version', () => {
-    const version = parseSpacetimeToolVersion(`
+    const output = `
 A new version of SpacetimeDB is available: v2.6.1 (current: v2.5.0)
-spacetimedb tool version 2.6.0; spacetimedb-lib version 2.6.0;
-`);
+Commit: d220349adb7af7eefa810eb08a185609356b83f6
+spacetimedb tool version 2.7.0; spacetimedb-lib version 2.7.0;
+`;
 
-    expect(version).toBe('2.6.0');
+    expect(parseSpacetimeToolVersion(output)).toBe('2.7.0');
+    expect(parseSpacetimeToolCommit(output)).toBe(
+      'd220349adb7af7eefa810eb08a185609356b83f6',
+    );
+  });
+
+  test('同为 2.7.0 时拒绝裸 tag 并接受 hotfix3 commit', () => {
+    expect(() =>
+      assertSpacetimeToolVersionMatchesWorkspace({
+        toolVersion: '2.7.0',
+        toolCommit: 'a08663c7b94688a2542577532d472f751e641f5b',
+        workspaceVersion: '2.7.0',
+      }),
+    ).toThrow('裸 tag');
+
+    expect(() =>
+      assertSpacetimeToolVersionMatchesWorkspace({
+        toolVersion: '2.7.0',
+        toolCommit: 'd220349adb7af7eefa810eb08a185609356b83f6',
+        workspaceVersion: '2.7.0',
+      }),
+    ).not.toThrow();
   });
 
   test('本机 spacetime 版本和 workspace 锁定版本不一致时直接报清楚', () => {
@@ -916,6 +939,28 @@ spacetimedb tool version 2.6.0; spacetimedb-lib version 2.6.0;
     }
   });
 
+  test('复用本地 SpacetimeDB standalone 时拒绝同版本裸 tag 记录', () => {
+    const tempDir = mkdtempSync(
+      join(tmpdir(), 'genarrative-spacetime-commit-'),
+    );
+    try {
+      writeFileSync(
+        join(tempDir, 'dev-spacetime-tool-version'),
+        '2.7.0\na08663c7b94688a2542577532d472f751e641f5b\n',
+        'utf8',
+      );
+
+      expect(() =>
+        assertReusableSpacetimeProcessVersionMatchesWorkspace({
+          dataDir: tempDir,
+          serverUrl: 'http://127.0.0.1:3101',
+        }),
+      ).toThrow('裸 tag');
+    } finally {
+      rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
+
   test('本地发布 403 时识别为身份权限问题，避免误杀 standalone', () => {
     const error = new Error(
       'Pre-publish check failed with status 403 Forbidden: c200... is not authorized to perform action on database c200...: update database',