修复维护退出阶段隐式拉取源码

将 Exit Maintenance 改为 agent none 并显式分配部署节点，只执行 current release 维护脚本。
增加生产运维静态门禁，禁止维护退出节点 checkout Git 或挂载 Git 凭据。
同步生产运维说明与 Jenkins 重启恢复场景的排障记录。

scripts/check-production-ops-guardrails.mjs

@@ -7092,6 +7092,30 @@ if ((fullPipelineMaintenanceHoldCalls?.length ?? 0) !== 2) {
   );
 }
 
+const exitMaintenanceStageOffset = fullPipelineContent.indexOf(
+  "stage('Exit Maintenance')",
+);
+const fullPipelinePostOffset = fullPipelineContent.indexOf(
+  '\n  post {',
+  exitMaintenanceStageOffset,
+);
+const exitMaintenanceStageContent =
+  exitMaintenanceStageOffset >= 0 && fullPipelinePostOffset > exitMaintenanceStageOffset
+    ? fullPipelineContent.slice(exitMaintenanceStageOffset, fullPipelinePostOffset)
+    : '';
+if (
+  !exitMaintenanceStageContent.includes('agent none') ||
+  !exitMaintenanceStageContent.includes('node(deployLabel)') ||
+  exitMaintenanceStageContent.includes("$class: 'GitSCM'") ||
+  exitMaintenanceStageContent.includes('checkout scm') ||
+  exitMaintenanceStageContent.includes('sshUserPrivateKey(')
+) {
+  failed = true;
+  console.error(
+    '[check:production-ops] Full Build 的 Exit Maintenance 必须使用 agent none + 显式 node 执行 current release 脚本，不得在目标机 checkout Git 或挂载 Git SSH 凭据。',
+  );
+}
+
 for (const file of nodeEnvFileCommandFiles) {
   const content = readFileSync(file, 'utf8');
   const commandText = content.replace(/\\\r?\n\s*/g, ' ');