合并 master 最新改动

同步 origin/master 至 b303605bf
保留项目总控 Runtime 决策并合入后台账号与画布更新
沿用当前 platform-llm LlmRunRequest 接口解决背景决策冲突

scripts/check-production-ops-guardrails.mjs

@@ -3,6 +3,21 @@
 import { readFileSync } from 'node:fs';
 
 const checks = [
+  {
+    file: 'package.json',
+    includes: '"check:rustfmt": "cargo fmt --all --manifest-path server-rs/Cargo.toml -- --check"',
+    reason: '仓库必须保留统一、只读的 Rust workspace 格式检查入口。',
+  },
+  {
+    file: 'jenkins/Jenkinsfile.production-api-build',
+    includes: 'npm run check:rustfmt',
+    reason: 'API 生产构建必须在编译前执行 Rust 格式检查。',
+  },
+  {
+    file: 'jenkins/Jenkinsfile.production-stdb-module-build',
+    includes: 'npm run check:rustfmt',
+    reason: 'Stdb module 生产构建必须在编译前执行 Rust 格式检查。',
+  },
   {
     file: 'server-rs/crates/spacetime-module/src/migration.rs',
     includes:
@@ -6827,6 +6842,32 @@ const nodeEnvFileCommandFiles = [
   'scripts/deploy/pingora-direct-rollback.sh',
 ];
 
+const jenkinsSourceCheckoutFiles = [
+  'jenkins/Jenkinsfile.production-api-build',
+  'jenkins/Jenkinsfile.production-web-build',
+  'jenkins/Jenkinsfile.production-stdb-module-build',
+  'jenkins/Jenkinsfile.production-full-build-and-deploy',
+  'jenkins/Jenkinsfile.production-database-export',
+  'jenkins/Jenkinsfile.production-database-import',
+  'jenkins/Jenkinsfile.production-server-provision',
+];
+
+const jenkinsLoopbackGitRemote =
+  "GIT_REMOTE_URL = 'ssh://git@127.0.0.1:2222/GenarrativeAI/Genarrative.git'";
+
+const databaseTargetSourceStashes = [
+  {
+    file: 'jenkins/Jenkinsfile.production-database-export',
+    targetStage: "stage('Export Database')",
+    stashName: 'database-export-source',
+  },
+  {
+    file: 'jenkins/Jenkinsfile.production-database-import',
+    targetStage: "stage('Import Database')",
+    stashName: 'database-import-source',
+  },
+];
+
 let failed = false;
 
 for (const check of checks) {
@@ -6845,6 +6886,72 @@ for (const check of checks) {
   }
 }
 
+for (const file of jenkinsSourceCheckoutFiles) {
+  const content = readFileSync(file, 'utf8');
+  if (!content.includes(jenkinsLoopbackGitRemote)) {
+    failed = true;
+    console.error(
+      `[check:production-ops] ${file} 的 Git checkout 必须固定使用本机 127.0.0.1:2222。`,
+    );
+  }
+  if (
+    !content.includes(
+      "GIT_REMOTE_CREDENTIAL_ID = 'genarrative-local-gitea-ssh'",
+    )
+  ) {
+    failed = true;
+    console.error(
+      `[check:production-ops] ${file} 必须继续显式使用 Jenkins Gitea SSH 凭据。`,
+    );
+  }
+  if (
+    content.includes('192.168.35.82') ||
+    content.includes('git.genarrative.world') ||
+    content.includes('genarrative-station/git')
+  ) {
+    failed = true;
+    console.error(
+      `[check:production-ops] ${file} 不得保留局域网 IP、HTTP 内网别名或公网 Git 地址。`,
+    );
+  }
+}
+
+for (const { file, targetStage, stashName } of databaseTargetSourceStashes) {
+  const content = readFileSync(file, 'utf8');
+  const targetStageOffset = content.indexOf(targetStage);
+  const prepareStageContent =
+    targetStageOffset >= 0 ? content.slice(0, targetStageOffset) : '';
+  const targetStageContent =
+    targetStageOffset >= 0 ? content.slice(targetStageOffset) : '';
+  if (
+    !prepareStageContent.includes("label 'linux && genarrative-build'") ||
+    !prepareStageContent.includes("$class: 'GitSCM'")
+  ) {
+    failed = true;
+    console.error(
+      `[check:production-ops] ${file} 必须只在 Jenkins Built-In Node 的 Prepare 阶段 checkout Git。`,
+    );
+  }
+  if (
+    !content.includes(`stash name: '${stashName}'`) ||
+    !targetStageContent.includes(`unstash '${stashName}'`)
+  ) {
+    failed = true;
+    console.error(
+      `[check:production-ops] ${file} 必须由本机 build 节点 stash 源码脚本，再交给数据库目标阶段。`,
+    );
+  }
+  if (
+    targetStageContent.includes("$class: 'GitSCM'") ||
+    targetStageContent.includes('sshUserPrivateKey(')
+  ) {
+    failed = true;
+    console.error(
+      `[check:production-ops] ${file} 的数据库目标阶段不得再次 checkout Git 或挂载 Git SSH 凭据。`,
+    );
+  }
+}
+
 const fullPipelineContent = readFileSync(
   'jenkins/Jenkinsfile.production-full-build-and-deploy',
   'utf8',