修复发布就绪等待与充值过期监听

为 API readiness 探测增加单次超时，避免端口已建立时无限挂起
修复 SpacetimeDB 枚举状态订阅导致的充值过期监听失败
在 pause-after-stdb 审批提示中强调运行时与迁移身份互斥
补齐生产发布门禁、回归测试与运维排障文档

scripts/check-production-api-deploy.mjs

@@ -333,8 +333,8 @@ function assertDeployCopiesPingoraDirectReleaseDependencies() {
   );
   assertIncludes(
     commandsLog,
-    'curl -fsS http://127.0.0.1:18082/readyz',
-    '部署脚本必须执行 readiness curl。',
+    'curl -fsS --max-time 2 http://127.0.0.1:18082/readyz',
+    '部署脚本必须为 readiness curl 设置单次超时，避免端口已建立但服务未响应时无限等待。',
   );
 
   if (existsSync(fixture.maintenanceFile)) {

scripts/check-production-ops-guardrails.mjs

@@ -167,6 +167,12 @@ const checks = [
     includes: 'readiness 通过，按参数保持维护模式',
     reason: 'API deploy 保留维护模式时必须在 readiness 通过后给出明确状态。',
   },
+  {
+    file: 'scripts/deploy/production-api-deploy.sh',
+    includes: 'curl -fsS --max-time 2 "${HEALTH_URL}"',
+    reason:
+      'API readiness 单次请求必须有超时，避免端口已建立但服务尚未响应时绕过重试上限无限挂起。',
+  },
   {
     file: 'jenkins/Jenkinsfile.production-api-deploy',
     includes:
@@ -383,6 +389,13 @@ const checks = [
       "booleanParam(name: 'EXIT_MAINTENANCE_MODE_AFTER_COMPLETION', defaultValue: true",
     reason: 'Full Build 必须显式提供完整发布成功后是否退出维护模式的选项。',
   },
+  {
+    file: 'jenkins/Jenkinsfile.production-full-build-and-deploy',
+    includes:
+      '确认 API runtime identity 未被授权为 migration operator 后再继续部署 API',
+    reason:
+      'Stdb/API 人工 gate 必须提醒审批人保持 migration operator 与运行时服务 identity 互斥。',
+  },
   {
     file: 'jenkins/Jenkinsfile.production-full-build-and-deploy',
     includes:

scripts/deploy/production-api-deploy.sh

@@ -1126,7 +1126,7 @@ wait_for_worker_controller_service "${WORKER_CONTROLLER_SERVICE}"
 
 echo "[production-api-deploy] 等待 readiness: ${HEALTH_URL}"
 for _ in {1..30}; do
-  if curl -fsS "${HEALTH_URL}" >/dev/null; then
+  if curl -fsS --max-time 2 "${HEALTH_URL}" >/dev/null; then
     if [[ "${KEEP_MAINTENANCE_MODE}" -eq 1 ]]; then
       echo "[production-api-deploy] readiness 通过，按参数保持维护模式: ${MAINTENANCE_FILE}"
     else