fix(deploy): 补齐集群备份兼容与切换前门禁

阿里云 OSS 的 S3 兼容层要求 virtual-hosted addressing，且 boto3 需要使用 Signature V2。本提交为 Barman 的归档、备份、保留与恢复统一挂载 AWS 配置，并将实际 WAL 归档和近期全备设为切换硬门禁。

同时补充 CNPG/etcdutl 固定版本安装、显式主库切换、三节点逐台停机、OSS 快照下载校验与远端临时 Secret 清理。已通过 ShellCheck、Kustomize、服务端 dry-run、迁移测试、发布脚本测试、敏感信息扫描及生产 precutover 验收。

scripts/cluster/install-cnpg-plugin.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+# shellcheck source=scripts/cluster/common.sh
+source "$script_dir/common.sh"
+
+load_cluster_env
+require_commands curl shasum tar
+
+plugin_version=1.29.1
+plugin_archive=kubectl-cnpg_"$plugin_version"_linux_x86_64.tar.gz
+plugin_sha256=2a550d5ee2224e5bb66b95602f8052fc50da50485f59f97b817a0c3b44b58581
+working_directory=$(mktemp -d "$cluster_root/.local-secrets/cluster/cnpg-plugin.XXXXXX")
+trap '[[ $working_directory == "$cluster_root"/.local-secrets/cluster/cnpg-plugin.* ]] && rm -rf -- "$working_directory"' \
+  EXIT HUP INT TERM
+
+curl -fsSL \
+  "https://github.com/cloudnative-pg/cloudnative-pg/releases/download/v${plugin_version}/${plugin_archive}" \
+  -o "$working_directory/$plugin_archive"
+actual_sha256=$(shasum -a 256 "$working_directory/$plugin_archive" | awk '{print $1}')
+[[ $actual_sha256 == "$plugin_sha256" ]] || {
+  echo 'kubectl-cnpg archive checksum mismatch' >&2
+  exit 1
+}
+tar -tzf "$working_directory/$plugin_archive" | grep -qx kubectl-cnpg
+tar -xzf "$working_directory/$plugin_archive" -C "$working_directory" kubectl-cnpg
+cluster_scp "$working_directory/kubectl-cnpg" "$CLUSTER_NINGBO_HOST:/root/kubectl-cnpg"
+cluster_ssh "$CLUSTER_NINGBO_HOST" bash -s -- "$plugin_version" <<'REMOTE'
+set -euo pipefail
+plugin_version=$1
+install -m 0755 /root/kubectl-cnpg /usr/local/bin/kubectl-cnpg
+unlink /root/kubectl-cnpg
+k3s kubectl cnpg version | grep -q "Version:${plugin_version}"
+REMOTE
+
+echo "cnpg_plugin_install=PASS version=$plugin_version sha256=$plugin_sha256"