fix(acceptance): 完善跨版本验收状态收口

生产流量处于旧失败验收 Run 的 validation 状态时，允许新验收接管任意已验证的 Git 祖先 release，而非仅允许 release manifest 的直接 base；仍保留 Run 状态、镜像 digest、revision 与当前集群 release CAS 校验。\n\n允许 pending Run 在激活前异常时直接标记为 failed，避免验收工具在 CAS 或网络错误后遗留无法结束的 Run。新增祖先关系脚本测试及临时 PostgreSQL 集成验证。\n\n验证：Go 全量测试、go vet、临时 PostgreSQL 集成测试、bash -n、ShellCheck、manual-release-test。

scripts/cluster/run-production-acceptance.sh

@@ -190,7 +190,6 @@ fi
 
 node "$cluster_root/scripts/release-manifest.mjs" validate "$release_manifest" >/dev/null
 release_sha=$(node "$cluster_root/scripts/release-manifest.mjs" get "$release_manifest" sourceSha)
-base_sha=$(node "$cluster_root/scripts/release-manifest.mjs" get "$release_manifest" baseReleaseSha)
 api_image=$(node "$cluster_root/scripts/release-manifest.mjs" get "$release_manifest" images.api)
 [[ $release_sha =~ ^[0-9a-f]{40}$ && $api_image =~ @sha256:[0-9a-f]{64}$ ]] || {
   echo 'release manifest is not full-SHA and digest pinned' >&2
@@ -1315,6 +1314,13 @@ deploy_protocol_emulator() {
     -n "$namespace" --timeout=300s
 }
 
+is_release_ancestor() {
+  local ancestor=$1
+  local descendant=$2
+  [[ $ancestor =~ ^[0-9a-f]{40}$ && $descendant =~ ^[0-9a-f]{40}$ ]] &&
+    git -C "$cluster_root" merge-base --is-ancestor "$ancestor" "$descendant"
+}
+
 create_and_activate_run() {
   local create_response=$temporary_root/create-run.json
   local activate_response=$temporary_root/activate-run.json
@@ -1393,8 +1399,8 @@ create_and_activate_run() {
         echo 'current-release validation mode has unexpected image digests' >&2
         return 1
       }
-    elif [[ -z $base_sha || $traffic_release != "$base_sha" ]]; then
-      echo 'refusing to replace validation mode outside the direct release base' >&2
+    elif ! is_release_ancestor "$traffic_release" "$release_sha"; then
+      echo 'refusing to replace validation mode owned by a non-ancestor release' >&2
       return 1
     fi
     body=$(jq -cn \