feat(deploy): trigger JD agent after human merge

deployment/requests/HLCC-HUMAN-MERGE-AUTO-DEPLOY-20260806.json

@@ -0,0 +1,92 @@
+{
+  "schema": "guanghu.existing-service-update-request/v1",
+  "request_id": "HLCC-HUMAN-MERGE-AUTO-DEPLOY-20260806",
+  "target_node": "JD-FD-PRIMARY",
+  "status": "SERVICE_UPDATE_PACKAGE_READY · DEPLOYMENT_PENDING",
+  "purpose": {
+    "what": "把光湖代码频道中由冰朔人工完成的main合并转换为不可变部署事件，交给京东常驻部署Agent执行。",
+    "why": "服务器已经具备清单校验、备份、部署、健康检查、回滚和回执能力，但代码频道的合并事件尚未接到部署队列，导致每次合并后仍需再次派发。",
+    "success": "仅Forgejo已合并PR且merged_by=bingshuo、目标仓库和分支匹配、改动包含deployment/requests下的有效清单时入队；普通push、关闭未合并、错误签名、其他合并者和重复投递均不产生第二次部署。",
+    "out_of_scope": [
+      "不因普通Git push自动部署",
+      "不执行PR或仓库提供的命令",
+      "不允许清单选择目标服务器或扩大权限",
+      "不修改光湖OS磁盘、内核、引导或启动状态"
+    ]
+  },
+  "module": {
+    "unit": "lake-lamp-authz.service",
+    "run_user": "guanghu-authz",
+    "install_root": "/opt/guanghu/lake-lamp-authz"
+  },
+  "service_update": {
+    "kind": "existing-systemd-service",
+    "require_existing_unit": true,
+    "required_existing_files": [
+      "server.js",
+      "deployment-event.js"
+    ]
+  },
+  "unit_source": "server-tools/lake-lamp-authz/lake-lamp-authz.service",
+  "files": [
+    {
+      "source": "server-tools/lake-lamp-authz/server.js",
+      "destination": "server.js",
+      "mode": "0644"
+    },
+    {
+      "source": "server-tools/lake-lamp-authz/deployment-event.js",
+      "destination": "deployment-event.js",
+      "mode": "0644"
+    },
+    {
+      "source": "server-tools/lake-lamp-authz/forgejo-merge-deployment.js",
+      "destination": "forgejo-merge-deployment.js",
+      "mode": "0644"
+    }
+  ],
+  "runtime_check": {
+    "url": "http://127.0.0.1:3921/health",
+    "expected": {
+      "ok": true,
+      "service": "lake-lamp-authz",
+      "merge_deployment_gate": {
+        "configured": true,
+        "mode": "human-merged-pull-request-only"
+      }
+    }
+  },
+  "acceptance_checks": [
+    {
+      "url": "http://127.0.0.1:3921/api/public/capabilities",
+      "expected": {
+        "schema": "guanghu.lake-lamp-public-workorder/v1"
+      }
+    }
+  ],
+  "bootstrap": {
+    "one_time": true,
+    "reason": "本清单合并前合并门尚不存在；首次由当前已授权实例按完整候选提交和同一回滚执行器安装，之后由人工合并自动触发。",
+    "webhook_target": "https://guanghulab.com/authz/api/deployment/forgejo-merge",
+    "webhook_event": "pull_request",
+    "secret_location": "/etc/guanghu/secrets/lake-lamp/authorization.env",
+    "secret_committed": false
+  },
+  "rollback": {
+    "automatic_on_failure": true,
+    "scope": "恢复server.js、deployment-event.js、原systemd单元并移除新增门模块，然后重启旧服务",
+    "receipt_required": true
+  },
+  "security": {
+    "hmac_sha256_required": true,
+    "allowed_repository": "bingshuo/guanghu-ice-heart",
+    "allowed_branch": "main",
+    "allowed_mergers": [
+      "bingshuo"
+    ],
+    "max_deployment_manifests_per_merge": 5,
+    "delivery_idempotency": true,
+    "repository_commands_executed": false,
+    "no_secrets": true
+  }
+}