Run mandatory RC gates with isolated CI failure checks

Local review candidate only. Explicitly selected inherited prerequisites and prior repair patches; unrelated WIP and independent MQ fixes are excluded. No push or deployment authorized.

.gitea/workflows/build.yml

@@ -9,7 +9,7 @@ name: build
 
 on:
   push:
-    branches: [ main ]
+    branches: [ main, codex/core-rc-20261023 ]
   workflow_dispatch:
     inputs:
       cache_bust:
@@ -42,6 +42,8 @@ jobs:
           git clone --depth 1 --branch main "http://x-access-token:${GITHUB_TOKEN}@gitea.yunhaixingtong.com/${{ github.repository }}.git" /tmp/src
           git -C /tmp/src fetch --depth 1 origin "$GITHUB_SHA"
           git -C /tmp/src checkout --detach FETCH_HEAD
+          test "$(git -C /tmp/src rev-parse HEAD)" = "$GITHUB_SHA"
+          echo "CI_SOURCE_SHA=$GITHUB_SHA"
           cp -a /tmp/src/. .
           rm -rf /tmp/src
           # 取提交备注首行，脱去换行/双引号/反斜杠（避免破坏 webhook JSON），截断到 200 字符
@@ -80,7 +82,19 @@ jobs:
           docker exec "$BUILD_CONTAINER" sh -c "printf '%s' '<settings><profiles><profile><id>nexus-repo</id><repositories><repository><id>nexus-internal</id><url>http://nexus:8081/repository/maven-public/</url><releases><enabled>true</enabled></releases><snapshots><enabled>true</enabled><updatePolicy>always</updatePolicy></snapshots></repository></repositories></profile></profiles><activeProfiles><activeProfile>nexus-repo</activeProfile></activeProfiles></settings>' > /root/.m2/settings.xml"
           # 为真实 MySQL 测试创建本次 job 独占的临时数据库；不映射宿主端口、不连接业务库。
           DB_CONTAINER="${BUILD_CONTAINER}-db"
-          trap 'docker rm -f "$BUILD_CONTAINER" "$DB_CONTAINER" >/dev/null 2>&1 || true' EXIT
+          cleanup_ci() {
+            result=$?
+            trap - EXIT
+            docker rm -fv "$BUILD_CONTAINER" "$DB_CONTAINER" >/dev/null 2>&1 || true
+            docker info >/dev/null 2>&1 || { echo 'CI_CONTAINER_CLEANUP=UNVERIFIED' >&2; exit 1; }
+            if docker inspect "$BUILD_CONTAINER" >/dev/null 2>&1 || docker inspect "$DB_CONTAINER" >/dev/null 2>&1; then
+              echo 'CI_CONTAINER_CLEANUP=FAILED' >&2
+              exit 1
+            fi
+            echo 'CI_CONTAINER_CLEANUP=PASS'
+            exit "$result"
+          }
+          trap cleanup_ci EXIT
           export MYSQL_ROOT_PASSWORD=$(od -An -N32 -tx1 /dev/urandom | tr -d ' \n')
           export MYSQL_PASSWORD=$(od -An -N32 -tx1 /dev/urandom | tr -d ' \n')
           docker create --name "$DB_CONTAINER" --network infra-infra-net \
@@ -96,6 +110,17 @@ jobs:
           [ "$ready" -eq 1 ] || { echo 'Isolated CI MySQL did not become ready' >&2; exit 1; }
           export CI_TEST_DB_URL="jdbc:mysql://${DB_CONTAINER}:3306/flowcenter_ci?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true"
           export CI_TEST_DB_USER=flow_ci CI_TEST_DB_PASSWORD="$MYSQL_PASSWORD"
+          tables=$(docker exec "$DB_CONTAINER" sh -c 'MYSQL_PWD="$MYSQL_PASSWORD" mysql -h127.0.0.1 -u"$MYSQL_USER" "$MYSQL_DATABASE" -Nse "SELECT COUNT(*) FROM information_schema.tables WHERE table_schema=DATABASE()"')
+          [ "$tables" = 14 ] || { echo "Expected 14 CI schema tables, got $tables" >&2; exit 1; }
+          echo "CI_SCHEMA_TABLES=$tables"
+          # 先在独立空 schema 验证真实 validate 失败会阻断打包；随后再生成正向候选 JAR。
+          printf '%s\n' 'CREATE DATABASE flowcenter_ci_invalid;' "GRANT ALL ON flowcenter_ci_invalid.* TO 'flow_ci'@'%';" | \
+            docker exec -i "$DB_CONTAINER" sh -c 'MYSQL_PWD="$MYSQL_ROOT_PASSWORD" mysql -uroot'
+          positive_db_url="$CI_TEST_DB_URL"
+          export CI_TEST_DB_URL="jdbc:mysql://${DB_CONTAINER}:3306/flowcenter_ci_invalid?useUnicode=true&characterEncoding=utf8&useSSL=false&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true"
+          docker exec -e CI_TEST_DB_URL -e CI_TEST_DB_USER -e CI_TEST_DB_PASSWORD \
+            "$BUILD_CONTAINER" sh -c 'cd /build && sh ci/verify-failure-guard.sh'
+          export CI_TEST_DB_URL="$positive_db_url"
           docker exec -e CI_TEST_DB_URL -e CI_TEST_DB_USER -e CI_TEST_DB_PASSWORD \
             "$BUILD_CONTAINER" sh -c 'cd /build && sh ci/test-gate.sh clean package'
           docker exec "$BUILD_CONTAINER" sh -c 'cd /build/target && cp *.jar app.jar'
@@ -104,7 +129,7 @@ jobs:
           docker rm -f "$BUILD_CONTAINER"
 
       - name: 构建并推送镜像
-        if: ${{ inputs.tests_only != 'true' }}
+        if: ${{ success() && github.ref == 'refs/heads/main' && inputs.tests_only != 'true' }}
         run: |
           set -e
           TAG=$(echo "$GITHUB_SHA" | cut -c1-8)
@@ -115,7 +140,7 @@ jobs:
 
       # 通知 projman：webhook 收到后只建档 Release(status=pending)，部署由运维在 DeployTab 手动触发（App.deployMode=manual）
       - name: 通知 projman 建档（部署由运维手动触发）
-        if: ${{ inputs.tests_only != 'true' }}
+        if: ${{ success() && github.ref == 'refs/heads/main' && inputs.tests_only != 'true' }}
         run: |
           curl -sS -X POST "http://192.168.10.160:8090/projman/api/deploy/webhook" \
             -H "Content-Type: application/json" \