Run mandatory RC gates with isolated CI failure checks

Local review candidate only. Explicitly selected inherited prerequisites and prior repair patches; unrelated WIP and independent MQ fixes are excluded. No push or deployment authorized.

.gitea/workflows/build.yml

@@ -9,7 +9,7 @@ name: build
 
 on:
   push:
-    branches: [ main ]
+    branches: [ main, codex/core-rc-20261023 ]
   workflow_dispatch:
     inputs:
       cache_bust:
@@ -42,6 +42,8 @@ jobs:
           git clone --depth 1 --branch main "http://x-access-token:${GITHUB_TOKEN}@gitea.yunhaixingtong.com/${{ github.repository }}.git" /tmp/src
           git -C /tmp/src fetch --depth 1 origin "$GITHUB_SHA"
           git -C /tmp/src checkout --detach FETCH_HEAD
+          test "$(git -C /tmp/src rev-parse HEAD)" = "$GITHUB_SHA"
+          echo "CI_SOURCE_SHA=$GITHUB_SHA"
           cp -a /tmp/src/. .
           rm -rf /tmp/src
           # 取提交备注首行，脱去换行/双引号/反斜杠（避免破坏 webhook JSON），截断到 200 字符
@@ -70,7 +72,19 @@ jobs:
           # GITHUB_RUN_ID 实例级唯一，再拼时间戳兜底。
           BUILD_CONTAINER="mavenbuild-${GITHUB_RUN_ID:-0}-$(date +%s)"
           echo "BUILD_CONTAINER=${BUILD_CONTAINER}"
-          trap 'docker rm -f "$BUILD_CONTAINER" >/dev/null 2>&1 || true' EXIT
+          cleanup_ci() {
+            result=$?
+            trap - EXIT
+            docker rm -fv "$BUILD_CONTAINER" >/dev/null 2>&1 || true
+            docker info >/dev/null 2>&1 || { echo 'CI_CONTAINER_CLEANUP=UNVERIFIED' >&2; exit 1; }
+            if docker inspect "$BUILD_CONTAINER" >/dev/null 2>&1; then
+              echo 'CI_CONTAINER_CLEANUP=FAILED' >&2
+              exit 1
+            fi
+            echo 'CI_CONTAINER_CLEANUP=PASS'
+            exit "$result"
+          }
+          trap cleanup_ci EXIT
           docker rm -f "$BUILD_CONTAINER" 2>/dev/null || true
           docker run -d --name "$BUILD_CONTAINER" \
             --network infra-infra-net \
@@ -85,7 +99,7 @@ jobs:
           docker rm -f "$BUILD_CONTAINER"
 
       - name: 构建并推送镜像
-        if: ${{ inputs.tests_only != 'true' }}
+        if: ${{ success() && github.ref == 'refs/heads/main' && inputs.tests_only != 'true' }}
         run: |
           set -e
           TAG=$(echo "$GITHUB_SHA" | cut -c1-8)
@@ -96,7 +110,7 @@ jobs:
 
       # 通知 projman：webhook 收到后只建档 Release(status=pending)，部署由运维在 DeployTab 手动触发（App.deployMode=manual）
       - name: 通知 projman 建档（部署由运维手动触发）
-        if: ${{ inputs.tests_only != 'true' }}
+        if: ${{ success() && github.ref == 'refs/heads/main' && inputs.tests_only != 'true' }}
         run: |
           curl -sS -X POST "http://192.168.10.160:8090/projman/api/deploy/webhook" \
             -H "Content-Type: application/json" \