fix(acceptance): 继承分片身份的验收角色

分片 API Key 已具有正确 scopes 和候选规则，但空角色无法通过基础接口权限检查。创建和重用分片身份时同步主验收用户角色，保持专属用户组与钱包隔离不变。\n\n验证：bash -n、ShellCheck。

scripts/cluster/run-production-acceptance.sh

@@ -429,7 +429,13 @@ ensure_acceptance_identity_shards() {
     return 1
   }
   identity_material=$(database_query "
-WITH desired AS (
+WITH primary_user AS (
+  SELECT roles
+  FROM gateway_users
+  WHERE id='$AI_GATEWAY_ACCEPTANCE_USER_ID'::uuid
+    AND status='active'
+    AND deleted_at IS NULL
+), desired AS (
   SELECT ordinal,
          'production-acceptance-shard-' || lpad(ordinal::text, 3, '0') AS user_key
   FROM generate_series(1, $((AI_GATEWAY_ACCEPTANCE_IDENTITY_SHARDS - 1))) ordinal
@@ -443,7 +449,7 @@ WITH desired AS (
          desired.user_key,
          'Production Acceptance Shard ' || lpad(desired.ordinal::text, 3, '0'),
          '$acceptance_group_id'::uuid,
-         '[]'::jsonb,
+         primary_user.roles,
          '{}'::jsonb,
          jsonb_build_object(
            'purpose', 'production_acceptance_shard',
@@ -452,8 +458,10 @@ WITH desired AS (
          ),
          'active'
   FROM desired
+  CROSS JOIN primary_user
   ON CONFLICT (user_key) DO UPDATE
   SET default_user_group_id=EXCLUDED.default_user_group_id,
+      roles=EXCLUDED.roles,
       metadata=EXCLUDED.metadata,
       status='active',
       deleted_at=NULL,