fix(deploy): 移除激活阶段外网依赖

正式激活时不再从 GitHub 下载并重装已健康运行的 cert-manager、CloudNativePG 和 Barman Operator；Operator 安装继续保留在 prepare 阶段。激活阶段只渲染、校验并启动已锁定 digest 的应用清单，避免维护窗口受外网波动影响。\n\n验证：bash -n、ShellCheck、git diff --check。

scripts/cluster/bootstrap-platform.sh

@@ -57,6 +57,7 @@ operator_checksums=(
   e0c5ff41bf5b01c0775bf225929b8423d543cd23e9742e4274fe7de8499cf93a
   d2e71e7b06822448f1a421f05781846cfdb9cc621e7ef32eef5e20c5133213b0
 )
+if [[ $mode == prepare ]]; then
   for index in 0 1 2; do
     operator=${operators[$index]}
     curl -fsSL "${operator_urls[$index]}" -o "$working_directory/$operator"
@@ -66,6 +67,7 @@ for index in 0 1 2; do
       exit 1
     }
   done
+fi
 
 cp -R "$cluster_root/deploy/kubernetes/production" "$working_directory/production"
 api_digest=${api_image##*@}
@@ -126,7 +128,11 @@ stringData:
 EOF
 chmod 0600 "$working_directory/bootstrap-secrets.yaml"
 
-for file in cert-manager.yaml cnpg.yaml barman.yaml easyai-production.yaml bootstrap-secrets.yaml; do
+platform_files=(easyai-production.yaml bootstrap-secrets.yaml)
+if [[ $mode == prepare ]]; then
+  platform_files=(cert-manager.yaml cnpg.yaml barman.yaml "${platform_files[@]}")
+fi
+for file in "${platform_files[@]}"; do
   cluster_scp "$working_directory/$file" "$CLUSTER_NINGBO_HOST:/root/$file"
 done
 
@@ -151,6 +157,7 @@ cleanup_bootstrap_files() {
 }
 trap cleanup_bootstrap_files EXIT HUP INT TERM
 
+if [[ $mode == prepare ]]; then
   $kubectl apply --server-side --force-conflicts -f /root/cert-manager.yaml >/dev/null
   $kubectl rollout status deployment/cert-manager -n cert-manager --timeout=180s
   $kubectl rollout status deployment/cert-manager-webhook -n cert-manager --timeout=180s
@@ -159,6 +166,7 @@ $kubectl apply --server-side --force-conflicts -f /root/cnpg.yaml >/dev/null
   $kubectl rollout status deployment/cnpg-controller-manager -n cnpg-system --timeout=600s
   $kubectl apply --server-side --force-conflicts -f /root/barman.yaml >/dev/null
   $kubectl rollout status deployment/barman-cloud -n cnpg-system --timeout=600s
+fi
 
 $kubectl create namespace easyai --dry-run=client -o yaml | $kubectl apply -f - >/dev/null
 $kubectl apply -f /root/bootstrap-secrets.yaml >/dev/null