refactor(runner): 收敛上游失败决策与轮转策略

将同平台重试、跨平台动作、健康副作用和冷却排队统一到单一失败决策，避免旧降级策略与 failover 重复执行。\n\n增加事务级单源保护、候选实时刷新、冷却错误契约、管理接口严格校验及兼容策略只读展示。\n\n验证：真实 Gateway HTTP/PostgreSQL 接受测试 10 项通过；go test ./...、pnpm openapi、pnpm lint、pnpm test、pnpm build 均通过。

packages/contracts/src/index.ts

@@ -278,10 +278,37 @@ export interface RuntimePolicySetUpsertRequest {
   status?: 'active' | 'disabled' | string;
 }
 
+export type RunnerFailoverAction = 'stop' | 'next' | 'cooldown_and_next' | 'demote_and_next' | 'disable_and_next';
+export type RunnerFailoverTarget = 'model' | 'platform';
+
+export interface RunnerFailoverActionRule {
+  enabled?: boolean;
+  categories?: string[];
+  codes?: string[];
+  errorCodes?: string[];
+  statusCodes?: number[];
+  keywords?: string[];
+  action: RunnerFailoverAction;
+  target?: RunnerFailoverTarget;
+  cooldownSeconds?: number;
+  demoteSteps?: number;
+}
+
+export interface RunnerFailoverPolicy {
+  enabled?: boolean;
+  maxPlatforms?: number;
+  maxDurationSeconds?: number;
+  actionRules?: RunnerFailoverActionRule[];
+  legacyFieldsDeprecated?: boolean;
+  deprecatedFields?: string[];
+  replacedBy?: 'actionRules' | string;
+  [key: string]: unknown;
+}
+
 export interface RuntimePolicyOverride {
   rateLimitPolicy?: RateLimitPolicy | Record<string, unknown>;
   retryPolicy?: Record<string, unknown>;
-  failoverPolicy?: Record<string, unknown>;
+  failoverPolicy?: RunnerFailoverPolicy;
   autoDisablePolicy?: Record<string, unknown>;
   degradePolicy?: Record<string, unknown>;
 }
@@ -291,7 +318,7 @@ export interface GatewayRunnerPolicy {
   policyKey: string;
   name: string;
   description?: string;
-  failoverPolicy?: Record<string, unknown>;
+  failoverPolicy?: RunnerFailoverPolicy;
   hardStopPolicy?: Record<string, unknown>;
   priorityDemotePolicy?: Record<string, unknown>;
   singleSourcePolicy?: Record<string, unknown>;
@@ -306,7 +333,7 @@ export interface GatewayRunnerPolicyUpsertRequest {
   policyKey?: string;
   name?: string;
   description?: string;
-  failoverPolicy?: Record<string, unknown>;
+  failoverPolicy?: RunnerFailoverPolicy;
   hardStopPolicy?: Record<string, unknown>;
   priorityDemotePolicy?: Record<string, unknown>;
   singleSourcePolicy?: Record<string, unknown>;