fix(acceptance): 消除 bootstrap 产物竞态

bootstrap 主容器完成后 Kubernetes 不允许继续 exec，导致无法取回只存在容器文件系统中的私密运行参数。使用共享 emptyDir 与限时导出 sidecar，在主容器退出码为零后复制 0600 产物并立即删除 Pod。\n\n验证：bash -n；ShellCheck；本地 CNPG 环境 32 身份 bootstrap、sidecar 导出和 runtime Schema 校验通过。

scripts/acceptance/local-cluster.sh

@@ -387,7 +387,11 @@ metadata:
   labels:
     easyai.io/environment: local-acceptance
 spec:
+  activeDeadlineSeconds: 600
   restartPolicy: Never
+  securityContext:
+    fsGroup: 10001
+    fsGroupChangePolicy: OnRootMismatch
   containers:
     - name: bootstrap
       image: $api_image
@@ -408,16 +412,42 @@ spec:
         - --identity-shards
         - "32"
         - --output
-        - /tmp/runtime.json
+        - /runtime/runtime.json
       envFrom:
         - secretRef:
             name: easyai-ai-gateway-runtime
+      volumeMounts:
+        - name: runtime
+          mountPath: /runtime
+    - name: runtime-export
+      image: $api_image
+      command: ["/bin/sh", "-ec", "sleep 600"]
+      volumeMounts:
+        - name: runtime
+          mountPath: /runtime
+          readOnly: true
+  volumes:
+    - name: runtime
+      emptyDir: {}
 EOF
-  kubectl --context "$context" -n "$namespace" wait \
+  local bootstrap_exit='' deadline=$((SECONDS + 300))
-    --for=jsonpath='{.status.phase}'=Succeeded pod/easyai-local-bootstrap --timeout=5m >/dev/null
+  while ((SECONDS < deadline)); do
+    bootstrap_exit=$(kubectl --context "$context" -n "$namespace" get \
+      pod/easyai-local-bootstrap -o json |
+      jq -r '.status.containerStatuses[]? | select(.name == "bootstrap") |
+        if .state.terminated then (.state.terminated.exitCode | tostring) else empty end')
+    [[ -z $bootstrap_exit ]] || break
+    sleep 1
+  done
+  if [[ $bootstrap_exit != 0 ]]; then
+    echo "local acceptance bootstrap failed or timed out: exit_code=${bootstrap_exit:-unknown}" >&2
+    kubectl --context "$context" -n "$namespace" logs \
+      pod/easyai-local-bootstrap -c bootstrap >&2 || true
+    exit 1
+  fi
   umask 077
   kubectl --context "$context" -n "$namespace" cp \
-    easyai-local-bootstrap:/tmp/runtime.json "$runtime_file" >/dev/null
+    -c runtime-export easyai-local-bootstrap:/runtime/runtime.json "$runtime_file" >/dev/null
   chmod 0600 "$runtime_file"
   kubectl --context "$context" -n "$namespace" delete pod easyai-local-bootstrap \
     --wait=true >/dev/null