ci: 建立生产镜像与 Tag 发布流水线

新增独立仓库级 Gitea Runner，main 和 PR 执行完整质量门禁与不可变 SHA 镜像构建；只有来自 main 历史的语义版本 Tag 才调用受限生产发布助手。专属 Buildx builder 将缓存限制为 2 GB。\n\n验证：流水线结构测试、ShellCheck、Go vet/test、govulncheck、前端 lint/test/build、Compose 渲染及高危依赖审计通过。

deploy/ci/act-runner-config.yaml

@@ -0,0 +1,35 @@
+log:
+  level: info
+
+runner:
+  file: /var/lib/easyai-gateway-runner/.runner
+  capacity: 1
+  envs:
+    GOPROXY: "https://goproxy.cn,direct"
+    GOSUMDB: "sum.golang.google.cn"
+    PATH: "/opt/easyai-gateway-ci/bin:/opt/easyai-gateway-ci/toolchains/go/bin:/opt/easyai-gateway-ci/toolchains/node/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+    AI_GATEWAY_GO_BUILD_IMAGE: "docker.m.daocloud.io/library/golang:1.26.5-alpine"
+    AI_GATEWAY_API_RUNTIME_IMAGE: "docker.m.daocloud.io/library/alpine:3.22"
+    AI_GATEWAY_NODE_BUILD_IMAGE: "docker.m.daocloud.io/library/node:24-alpine"
+    AI_GATEWAY_WEB_RUNTIME_IMAGE: "docker.m.daocloud.io/library/nginx:1.27-alpine"
+  timeout: 3h
+  shutdown_timeout: 5m
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels:
+    - "easyai-gateway-linux:host"
+
+cache:
+  enabled: true
+  dir: /var/lib/easyai-gateway-runner/cache
+
+container:
+  docker_host: "-"
+  privileged: false
+  force_pull: false
+  force_rebuild: false
+  valid_volumes: []
+
+host:
+  workdir_parent: /var/lib/easyai-gateway-runner/work

deploy/ci/easyai-gateway-act-runner.service

@@ -0,0 +1,31 @@
+[Unit]
+Description=EasyAI AI Gateway Gitea Actions runner
+After=network-online.target docker.service
+Wants=network-online.target docker.service
+
+[Service]
+Type=simple
+User=easyai-gateway-runner
+Group=easyai-gateway-runner
+WorkingDirectory=/var/lib/easyai-gateway-runner
+Environment=HOME=/var/lib/easyai-gateway-runner
+Environment=PATH=/opt/easyai-gateway-ci/bin:/opt/easyai-gateway-ci/toolchains/go/bin:/opt/easyai-gateway-ci/toolchains/node/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+# Gitea 1.22 can leave a long-running poll stale after a completed host job.
+# Process exactly one job, then let Restart=always create a fresh poller.
+ExecStart=/opt/easyai-gateway-ci/bin/gitea-runner --config /etc/easyai-gateway-runner/config.yaml daemon --once
+Restart=always
+RestartSec=5s
+TimeoutStopSec=330s
+# Tag jobs invoke one SHA-validating root helper. Docker access already gives
+# this dedicated repository runner an equivalent host-root trust boundary.
+NoNewPrivileges=false
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ReadWritePaths=/var/lib/easyai-gateway-runner
+
+[Install]
+WantedBy=multi-user.target