fix(acceptance): 允许无运行时差异的工具更新

验收编排修复被正确分类为 components=none，但旧 CAS 要求工具 HEAD 与线上 release 完全相等，导致无运行时变化也必须重发镜像。

现在仅允许线上 release 到工具 HEAD 之间为无迁移、无 API/Web 运行时变化的后代提交；任何运行时或迁移差异仍立即阻断。

验证：bash -n、ShellCheck、验收报告测试、release-components 分类检查。

scripts/cluster/run-production-acceptance.sh

@@ -170,14 +170,25 @@ if [[ $skip_local_acceptance != true ]]; then
     exit 1
   }
 fi
-[[ $(git -C "$cluster_root" rev-parse HEAD) == "$release_sha" ]] || {
-  echo 'working copy HEAD must equal the release SHA' >&2
-  exit 1
-}
 [[ -z $(git -C "$cluster_root" status --short) ]] || {
   echo 'production acceptance requires a clean release working copy' >&2
   exit 1
 }
+acceptance_tool_sha=$(git -C "$cluster_root" rev-parse HEAD)
+if [[ $acceptance_tool_sha != "$release_sha" ]]; then
+  git -C "$cluster_root" merge-base --is-ancestor "$release_sha" "$acceptance_tool_sha" || {
+    echo 'production release must be an ancestor of the acceptance tool HEAD' >&2
+    exit 1
+  }
+  acceptance_tool_delta=$(node "$cluster_root/scripts/release-components.mjs" \
+    "$release_sha" "$acceptance_tool_sha")
+  [[ $(jq -r '.components' <<<"$acceptance_tool_delta") == none &&
+     $(jq -r '.migrationsChanged' <<<"$acceptance_tool_delta") == false ]] || {
+    echo 'acceptance tool HEAD contains runtime or migration changes beyond the production release' >&2
+    exit 1
+  }
+  echo "acceptance_tool_delta=PASS release=$release_sha tool_sha=$acceptance_tool_sha runtime_changes=false"
+fi
 
 namespace=${AI_GATEWAY_K3S_NAMESPACE:-easyai}
 remote_release_helper=${AI_GATEWAY_REMOTE_RELEASE_HELPER:-/usr/local/sbin/easyai-ai-gateway-cluster-release}