chore(release): 明确生产发布授权并支持集群发布

将发布与上线授权边界调整为一次明确的生产发布指令可连续执行 publish 和 deploy，同时保留仅构建镜像时的停止边界。

为现有发布脚本增加 compose/kubernetes helper 选择和显式 SSH 私钥支持，保持完整 SHA、digest 与生产基线校验不变。

验证：bash -n、ShellCheck、manual-release-test。

scripts/publish-release-images.sh

@@ -6,7 +6,14 @@ cd "$root"
 
 components=auto
 production_host=${AI_GATEWAY_PRODUCTION_HOST:-root@110.42.51.33}
-remote_helper=${AI_GATEWAY_REMOTE_RELEASE_HELPER:-/usr/local/sbin/easyai-ai-gateway-release}
+deploy_mode=${AI_GATEWAY_DEPLOY_MODE:-compose}
+case $deploy_mode in
+  compose) default_remote_helper=/usr/local/sbin/easyai-ai-gateway-release ;;
+  kubernetes) default_remote_helper=/usr/local/sbin/easyai-ai-gateway-cluster-release ;;
+  *) echo 'AI_GATEWAY_DEPLOY_MODE must be compose or kubernetes' >&2; exit 1 ;;
+esac
+remote_helper=${AI_GATEWAY_REMOTE_RELEASE_HELPER:-$default_remote_helper}
+production_ssh_key=${AI_GATEWAY_PRODUCTION_SSH_KEY:-}
 registry=${AI_GATEWAY_IMAGE_REGISTRY:-registry.cn-shanghai.aliyuncs.com/easyaigc}
 platform=linux/amd64
 platform_probe_image=${AI_GATEWAY_PLATFORM_PROBE_IMAGE:-docker.m.daocloud.io/library/alpine:3.22}
@@ -18,8 +25,8 @@ Usage:
   scripts/publish-release-images.sh [--components auto|api|web|all]
 
 This command only builds, smoke-tests, and pushes immutable images. It never
-changes production. The generated manifest must be deployed separately with
-scripts/deploy-production-release.sh after explicit confirmation.
+changes production. When the user requested a production release, continue
+with scripts/deploy-production-release.sh without requesting confirmation again.
 
 Environment:
   AI_GATEWAY_PRODUCTION_HOST       SSH target used for read-only release status
@@ -60,6 +67,14 @@ esac
   echo 'AI_GATEWAY_REMOTE_RELEASE_HELPER must be an absolute safe path' >&2
   exit 1
 }
+ssh_options=(-o BatchMode=yes -o ConnectTimeout=8)
+if [[ -n $production_ssh_key ]]; then
+  [[ $production_ssh_key == /* && -f $production_ssh_key && ! -L $production_ssh_key ]] || {
+    echo 'AI_GATEWAY_PRODUCTION_SSH_KEY must be an absolute regular file' >&2
+    exit 1
+  }
+  ssh_options+=(-i "$production_ssh_key")
+fi
 [[ $registry =~ ^[A-Za-z0-9.-]+(:[0-9]+)?(/[A-Za-z0-9._-]+)+$ ]] || {
   echo 'AI_GATEWAY_IMAGE_REGISTRY has an invalid format' >&2
   exit 1
@@ -114,8 +129,8 @@ if [[ -n $status_file_override ]]; then
   [[ -f $status_file_override ]] || fail 'AI_GATEWAY_RELEASE_STATUS_FILE does not exist'
   cp "$status_file_override" "$status_file"
   has_status=1
-elif ssh -o BatchMode=yes -o ConnectTimeout=8 "$production_host" \
-  "$remote_helper status" >"$status_file" 2>/dev/null; then
+elif ssh "${ssh_options[@]}" "$production_host" \
+  "$remote_helper" status >"$status_file" 2>/dev/null; then
   has_status=1
 fi