feat(deploy): 增加三节点 K3s 高可用迁移能力

新增 WireGuard 全互联、三 server embedded-etcd K3s、CloudNativePG 双实例、Barman OSS 备份、双 NGINX、Kubernetes Secret/RBAC 与本地旧文件按严格 24 小时清理。

新增维护窗口数据迁移、digest 固定滚动发布、应用回滚、跨节点文件 E2E、节点和数据库故障演练、CNPG 恢复与 etcd 快照验收脚本；洛杉矶仅作为带 NoSchedule 污点的仲裁节点。

所有生产 Secret 只在执行时从 0600 本地环境和旧生产容器导入，仓库不保存凭据；公网入口保持人工 DNS 故障切换边界。

验证：bash -n、ShellCheck、kubectl kustomize、Node 语法检查、Secret 扫描、OSS put/head/delete 实测。

scripts/cluster/install-release-helper.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+# shellcheck source=scripts/cluster/common.sh
+source "$script_dir/common.sh"
+load_cluster_env
+
+cluster_ssh "$CLUSTER_NINGBO_HOST" \
+  'install -d -m 0755 /usr/local/lib/easyai-ai-gateway-release'
+cluster_scp "$cluster_root/deploy/kubernetes/easyai-ai-gateway-cluster-release" \
+  "$CLUSTER_NINGBO_HOST:/usr/local/sbin/easyai-ai-gateway-cluster-release"
+cluster_scp "$cluster_root/deploy/kubernetes/easyai-ai-gateway-cluster-release.conf.example" \
+  "$CLUSTER_NINGBO_HOST:/etc/easyai-ai-gateway-cluster-release.conf"
+cluster_scp "$cluster_root/scripts/release-manifest.mjs" \
+  "$CLUSTER_NINGBO_HOST:/usr/local/lib/easyai-ai-gateway-release/release-manifest.mjs"
+cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
+set -euo pipefail
+chmod 0750 /usr/local/sbin/easyai-ai-gateway-cluster-release
+chmod 0640 /etc/easyai-ai-gateway-cluster-release.conf
+chmod 0755 /usr/local/lib/easyai-ai-gateway-release/release-manifest.mjs
+REMOTE
+echo 'cluster_release_helper_install=PASS'