fix(release): 补齐香港 Worker 权限与精确回滚

生产容量控制器原 Role 仅允许访问宁波 Worker，香港 Worker 启用后导致 reconciliation 返回 403。补齐香港 Deployment 及 scale 子资源权限。

同时将失败发布的 Deployment 恢复从合并式 apply 改为基于资源版本的精确 replace，并优先删除发布前不存在的站点，避免新增环境变量残留导致回滚卡死。

验证：bash -n、ShellCheck、cluster release helper、manual release 与差异检查均通过。

tests/release/cluster-release-helper-test.sh

@@ -102,6 +102,16 @@ fi
 grep -Fq 'AI_GATEWAY_WORKER_REPLICAS_HONGKONG=1' \
   "$root/deploy/kubernetes/easyai-ai-gateway-cluster-release.conf.example"
 grep -Fq "hongkong) replicas=\$AI_GATEWAY_WORKER_REPLICAS_HONGKONG" "$helper"
+grep -Fq "\"\${kubectl[@]}\" replace -f -" "$helper"
+if grep -Fq "\"\${kubectl[@]}\" apply -f \"\$snapshot\"" "$helper"; then
+  echo 'deployment rollback still uses merge semantics instead of exact restore' >&2
+  exit 1
+fi
+if [[ $(grep -Fc 'resourceNames: ["easyai-worker-ningbo", "easyai-worker-hongkong"]' \
+  "$root/deploy/kubernetes/production/service-account-rbac.yaml") -ne 2 ]]; then
+  echo 'capacity controller RBAC does not cover both Worker deployments' >&2
+  exit 1
+fi
 
 hongkong_strategy=$(deployment_strategy easyai-worker-hongkong)
 grep -Fq '  replicas: 1' <<<"$hongkong_strategy"