补齐发布包维护脚本

把 API 部署与维护开关脚本复制进 current release
补充发布夹具对三个随包脚本的存在性断言
记录 Full 退出维护依赖 current release 自包含脚本

docs/project-memory/shared-memory/pitfalls.md

@@ -2980,5 +2980,5 @@
 
 - 现象：Full Job 参数页没有“完整发布成功后是否退出维护”选项，或者补了选项后 API readiness 一通过仍自动撤掉维护。
 - 原因：维护退出发生在随 API artifact 发布的 `production-api-deploy.sh` 内；Full、API Deploy Job 和脚本任一层没有透传，最终都会回到固定执行 `maintenance-off.sh`。Declarative Pipeline 参数还要等 live Job 加载新版 Jenkinsfile 后才会刷新。
-- 处理：Full 使用 `EXIT_MAINTENANCE_MODE_AFTER_COMPLETION` 表达产品选择，Stdb Publish 和 API Deploy 全程固定保持维护，Web Deploy 成功后才进入独立最终退出阶段；API Deploy 的独立 `KEEP_MAINTENANCE_MODE` 再转换为脚本 `--keep-maintenance-mode`。默认值仍在 Full 结束时退出维护，避免定时 dev 发布行为变化。
-- 验证：API deploy fixture 必须覆盖成功发布并保留 marker；生产运维静态门禁同时反查 Full 参数、下游透传、API Deploy 参数和脚本 flag。推送后用 fail-closed 首阶段运行刷新 live Job 参数，再核对 `config.xml`，不能只看仓库文件。
+- 处理：Full 使用 `EXIT_MAINTENANCE_MODE_AFTER_COMPLETION` 表达产品选择，Stdb Publish 和 API Deploy 全程固定保持维护，Web Deploy 成功后才进入独立最终退出阶段；API Deploy 的独立 `KEEP_MAINTENANCE_MODE` 再转换为脚本 `--keep-maintenance-mode`。API deploy 还必须把 `production-api-deploy.sh`、`maintenance-on.sh` 和 `maintenance-off.sh` 从同一 build artifact 复制进 current release，否则 Full 最终阶段即使有选项也找不到随包退出脚本。默认值仍在 Full 结束时退出维护，避免定时 dev 发布行为变化。
+- 验证：API deploy fixture 必须覆盖成功发布并保留 marker，还要断言 current release 中三个部署 / 维护脚本存在；生产运维静态门禁同时反查 Full 参数、下游透传、API Deploy 参数和脚本 flag。推送后用 fail-closed 首阶段运行刷新 live Job 参数，再核对 `config.xml`，不能只看仓库文件。

scripts/check-production-api-deploy.mjs

@@ -137,6 +137,18 @@ function assertDeployCopiesPingoraDirectReleaseDependencies() {
     );
   }
 
+  assertFileExists(
+    path.join(releaseDir, 'scripts/deploy/production-api-deploy.sh'),
+    'current release 必须包含 API 部署脚本。',
+  );
+  assertFileExists(
+    path.join(releaseDir, 'scripts/deploy/maintenance-on.sh'),
+    'current release 必须包含进入维护脚本。',
+  );
+  assertFileExists(
+    path.join(releaseDir, 'scripts/deploy/maintenance-off.sh'),
+    'current release 必须包含退出维护脚本。',
+  );
   assertFileExists(
     path.join(releaseDir, 'scripts/deploy/pingora-direct-enable.sh'),
     'current release 必须包含 Pingora 直连启用脚本。',

scripts/deploy/production-api-deploy.sh

@@ -896,6 +896,9 @@ if [[ -f "${SOURCE_DIR}/pingora-gateway" ]]; then
 fi
 
 BACKUP_SCRIPT_SOURCE="${SOURCE_DIR}/scripts/database-backup-to-oss.mjs"
+API_DEPLOY_SCRIPT_SOURCE="${SOURCE_DIR}/scripts/deploy/production-api-deploy.sh"
+MAINTENANCE_ON_SCRIPT_SOURCE="${SOURCE_DIR}/scripts/deploy/maintenance-on.sh"
+MAINTENANCE_OFF_SCRIPT_SOURCE="${SOURCE_DIR}/scripts/deploy/maintenance-off.sh"
 HEALTH_PATROL_SCRIPT_SOURCE="${SOURCE_DIR}/scripts/ops/production-health-patrol.mjs"
 PINGORA_CURRENT_RELEASE_AUDIT_SCRIPT_SOURCE="${SOURCE_DIR}/scripts/ops/pingora-current-release-audit.mjs"
 PINGORA_DIRECT_REHEARSAL_STATUS_SCRIPT_SOURCE="${SOURCE_DIR}/scripts/ops/pingora-direct-rehearsal-status.mjs"
@@ -922,6 +925,19 @@ SYSTEMD_DEPLOY_DIR_SOURCE="${SOURCE_DIR}/deploy/systemd"
 NGINX_DEPLOY_DIR_SOURCE="${SOURCE_DIR}/deploy/nginx"
 ENV_DEPLOY_DIR_SOURCE="${SOURCE_DIR}/deploy/env"
 mkdir -p "${RELEASE_CONTENT_DIR}/scripts" "${RELEASE_CONTENT_DIR}/scripts/deploy" "${RELEASE_CONTENT_DIR}/scripts/ops" "${RELEASE_CONTENT_DIR}/deploy"
+if [[ ! -f "${API_DEPLOY_SCRIPT_SOURCE}" ]]; then
+  echo "[production-api-deploy] 发布产物缺少 API 部署脚本: ${SOURCE_DIR}/scripts/deploy/production-api-deploy.sh" >&2
+  exit 1
+fi
+cp "${API_DEPLOY_SCRIPT_SOURCE}" "${RELEASE_CONTENT_DIR}/scripts/deploy/production-api-deploy.sh"
+chmod 0755 "${RELEASE_CONTENT_DIR}/scripts/deploy/production-api-deploy.sh"
+if [[ ! -f "${MAINTENANCE_ON_SCRIPT_SOURCE}" || ! -f "${MAINTENANCE_OFF_SCRIPT_SOURCE}" ]]; then
+  echo "[production-api-deploy] 发布产物缺少维护模式脚本: ${SOURCE_DIR}/scripts/deploy" >&2
+  exit 1
+fi
+cp "${MAINTENANCE_ON_SCRIPT_SOURCE}" "${RELEASE_CONTENT_DIR}/scripts/deploy/maintenance-on.sh"
+cp "${MAINTENANCE_OFF_SCRIPT_SOURCE}" "${RELEASE_CONTENT_DIR}/scripts/deploy/maintenance-off.sh"
+chmod 0755 "${RELEASE_CONTENT_DIR}/scripts/deploy/maintenance-on.sh" "${RELEASE_CONTENT_DIR}/scripts/deploy/maintenance-off.sh"
 if [[ ! -f "${BACKUP_SCRIPT_SOURCE}" ]]; then
   echo "[production-api-deploy] 发布产物缺少数据库备份脚本: ${SOURCE_DIR}/scripts/database-backup-to-oss.mjs" >&2
   exit 1