fix(acceptance): 安全接管直接基线失败任务

允许新发布在 validation 状态下接管其直接 base release 的失败 Run。接管前严格核对旧 Run 状态、流量 CAS 字段和 manifest 基线，并使用旧 CAS 字段中止旧 Run，再激活新 Run。\n\n验证：bash -n；shellcheck -x -P .；git diff --check。

scripts/cluster/run-production-acceptance.sh

@@ -56,6 +56,7 @@ require_commands curl git go jq node openssl sed
 
 node "$cluster_root/scripts/release-manifest.mjs" validate "$release_manifest" >/dev/null
 release_sha=$(node "$cluster_root/scripts/release-manifest.mjs" get "$release_manifest" sourceSha)
+base_sha=$(node "$cluster_root/scripts/release-manifest.mjs" get "$release_manifest" baseReleaseSha)
 api_image=$(node "$cluster_root/scripts/release-manifest.mjs" get "$release_manifest" images.api)
 [[ $release_sha =~ ^[0-9a-f]{40}$ && $api_image =~ @sha256:[0-9a-f]{64}$ ]] || {
   echo 'release manifest is not full-SHA and digest pinned' >&2
@@ -280,6 +281,8 @@ create_and_activate_run() {
 
   admin_request GET /api/admin/system/acceptance/traffic-mode '' "$traffic_response"
   local traffic_mode previous_run_id previous_status
+  local traffic_release traffic_api_digest traffic_worker_digest
+  local previous_release previous_api_digest previous_worker_digest
   traffic_mode=$(jq -r '.mode // empty' "$traffic_response")
   if [[ $traffic_mode == validation ]]; then
     previous_run_id=$(jq -r '.runId // empty' "$traffic_response")
@@ -287,12 +290,6 @@ create_and_activate_run() {
       echo 'validation mode does not reference a different previous Run' >&2
       return 1
     }
-    [[ $(jq -r '.releaseSha // empty' "$traffic_response") == "$release_sha" &&
-       $(jq -r '.apiImageDigest // empty' "$traffic_response") == "$api_digest" &&
-       $(jq -r '.workerImageDigest // empty' "$traffic_response") == "$worker_digest" ]] || {
-      echo 'refusing to replace validation mode for a different production release' >&2
-      return 1
-    }
     admin_request GET "/api/admin/system/acceptance/runs/$previous_run_id" '' \
       "$previous_run_response"
     previous_status=$(jq -r '.status // empty' "$previous_run_response")
@@ -300,11 +297,33 @@ create_and_activate_run() {
       echo "refusing to replace previous acceptance Run in status $previous_status" >&2
       return 1
     }
+    traffic_release=$(jq -r '.releaseSha // empty' "$traffic_response")
+    traffic_api_digest=$(jq -r '.apiImageDigest // empty' "$traffic_response")
+    traffic_worker_digest=$(jq -r '.workerImageDigest // empty' "$traffic_response")
+    previous_release=$(jq -r '.releaseSha // empty' "$previous_run_response")
+    previous_api_digest=$(jq -r '.apiImageDigest // empty' "$previous_run_response")
+    previous_worker_digest=$(jq -r '.workerImageDigest // empty' "$previous_run_response")
+    [[ $traffic_release == "$previous_release" &&
+       $traffic_api_digest == "$previous_api_digest" &&
+       $traffic_worker_digest == "$previous_worker_digest" ]] || {
+      echo 'previous failed Run does not match the active validation CAS fields' >&2
+      return 1
+    }
+    if [[ $traffic_release == "$release_sha" ]]; then
+      [[ $traffic_api_digest == "$api_digest" &&
+         $traffic_worker_digest == "$worker_digest" ]] || {
+        echo 'current-release validation mode has unexpected image digests' >&2
+        return 1
+      }
+    elif [[ -z $base_sha || $traffic_release != "$base_sha" ]]; then
+      echo 'refusing to replace validation mode outside the direct release base' >&2
+      return 1
+    fi
     body=$(jq -cn \
       --argjson revision "$(jq -r '.revision' "$traffic_response")" \
-      --arg releaseSha "$release_sha" \
-      --arg apiDigest "$api_digest" \
-      --arg workerDigest "$worker_digest" \
+      --arg releaseSha "$traffic_release" \
+      --arg apiDigest "$traffic_api_digest" \
+      --arg workerDigest "$traffic_worker_digest" \
       '{
         revision:$revision,
         releaseSha:$releaseSha,