fix(controller): 隔离无关媒体凭据校验

容量控制器只负责读取容量状态和调整 Worker 副本，按最小权限不注入 OSS 或供应商凭据；全局媒体配置校验却导致控制器在生产启动时 CrashLoop。

容量控制器角色现在跳过不会使用的直传 OSS 校验，API/Worker 仍保持原校验；发布先以零副本应用目标状态，再用精确镜像和同构配置运行 Ready 预检，成功后才扩到双副本；同时补齐迁移 Job 的 restricted PodSecurity 配置。

验证：Go 全量测试、go vet、角色回归测试、bash -n、ShellCheck、人工发布测试、生产 server-side dry-run。

deploy/kubernetes/easyai-ai-gateway-cluster-release

@@ -402,9 +402,117 @@ rollout_capacity_controller() {
     "${kubectl[@]}" set image deployment/easyai-capacity-controller -n "$NAMESPACE" \
       "capacity-controller=$api_image"
   fi
+  "${kubectl[@]}" scale deployment/easyai-capacity-controller -n "$NAMESPACE" --replicas=2
   "${kubectl[@]}" rollout status deployment/easyai-capacity-controller -n "$NAMESPACE" --timeout=300s
 }
 
+run_capacity_controller_preflight() {
+  local source_sha=$1
+  local api_image=$2
+  local pod=easyai-capacity-controller-preflight-${source_sha:0:12}
+  "${kubectl[@]}" delete pod "$pod" -n "$NAMESPACE" \
+    --ignore-not-found=true --wait=true >/dev/null
+  cat <<EOF | "${kubectl[@]}" apply -f - >/dev/null
+apiVersion: v1
+kind: Pod
+metadata:
+  name: $pod
+  namespace: $NAMESPACE
+  labels:
+    easyai.io/preflight: capacity-controller
+    easyai.io/release: $source_sha
+spec:
+  restartPolicy: Never
+  serviceAccountName: easyai-capacity-controller
+  nodeSelector:
+    easyai.io/workload: "true"
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 10001
+    runAsGroup: 10001
+    fsGroup: 10001
+    seccompProfile:
+      type: RuntimeDefault
+  imagePullSecrets:
+    - name: easyai-registry
+  containers:
+    - name: capacity-controller
+      image: $api_image
+      imagePullPolicy: IfNotPresent
+      envFrom:
+        - configMapRef:
+            name: easyai-ai-gateway-config
+      env:
+        - name: AI_GATEWAY_PROCESS_ROLE
+          value: capacity-controller
+        - name: AI_GATEWAY_DATABASE_URL
+          valueFrom:
+            secretKeyRef:
+              name: easyai-ai-gateway-runtime
+              key: AI_GATEWAY_DATABASE_URL
+        - name: AI_GATEWAY_DATABASE_MAX_CONNS
+          value: "4"
+        - name: AI_GATEWAY_DATABASE_CRITICAL_MAX_CONNS
+          value: "0"
+        - name: AI_GATEWAY_DATABASE_RIVER_MAX_CONNS
+          value: "0"
+        - name: AI_GATEWAY_DATABASE_MIN_IDLE_CONNS
+          value: "1"
+        - name: AI_GATEWAY_WORKER_DATABASE_MAX_CONNS
+          value: "$AI_GATEWAY_DATABASE_MAX_CONNS"
+        - name: AI_GATEWAY_POSTGRES_NON_WORKER_CONNECTION_BUDGET
+          value: "$AI_GATEWAY_POSTGRES_NON_WORKER_CONNECTION_BUDGET"
+        - name: AI_GATEWAY_WORKER_AUTOSCALING_ENABLED
+          value: "false"
+        - name: AI_GATEWAY_REVISION
+          value: "$source_sha"
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+      readinessProbe:
+        httpGet:
+          path: /readyz
+          port: 8088
+        periodSeconds: 2
+        timeoutSeconds: 2
+        failureThreshold: 30
+      resources:
+        requests:
+          cpu: 50m
+          memory: 64Mi
+        limits:
+          cpu: 200m
+          memory: 256Mi
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop: ["ALL"]
+        readOnlyRootFilesystem: true
+      volumeMounts:
+        - name: temporary-files
+          mountPath: /tmp
+  volumes:
+    - name: temporary-files
+      emptyDir:
+        sizeLimit: 64Mi
+EOF
+  if ! "${kubectl[@]}" wait --for=condition=Ready "pod/$pod" \
+    -n "$NAMESPACE" --timeout=120s; then
+    "${kubectl[@]}" delete pod "$pod" -n "$NAMESPACE" \
+      --ignore-not-found=true --wait=true >/dev/null || true
+    echo 'capacity controller exact-image preflight failed' >&2
+    return 1
+  fi
+  "${kubectl[@]}" delete pod "$pod" -n "$NAMESPACE" \
+    --ignore-not-found=true --wait=true >/dev/null
+  echo "capacity_controller_preflight=PASS release=$source_sha"
+}
+
 rollout_api_capacity_site() {
   local site=$1
   "${kubectl[@]}" set env "deployment/easyai-api-$site" -n "$NAMESPACE" \
@@ -519,6 +627,12 @@ spec:
   template:
     spec:
       restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        seccompProfile:
+          type: RuntimeDefault
       imagePullSecrets:
         - name: easyai-registry
       nodeSelector:
@@ -527,6 +641,10 @@ spec:
         - name: migrator
           image: $api_image
           command: ["/app/easyai-ai-gateway-migrate"]
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
           envFrom:
             - secretRef:
                 name: easyai-ai-gateway-runtime
@@ -713,16 +831,20 @@ activate_manifest() {
   if [[ $action == deploy ]]; then
     verify_migration_version "$migration_version"
   fi
-  capacity_controller_replicas=2
-  if [[ $action == rollback ]]; then
-    capacity_controller_replicas=0
-  fi
+  capacity_controller_replicas=0
   if ! apply_desired_state "$api_image" "$web_image" "$capacity_controller_replicas"; then
     echo '[cluster-release] desired state apply failed; restoring exact deployment snapshot' >&2
     restore_application_deployments "$deployment_snapshot" || true
     rm -f -- "$deployment_snapshot" "$current_file"
     return 1
   fi
+  if [[ $action == deploy && $api_changed == true ]] &&
+     ! run_capacity_controller_preflight "$source_sha" "$api_image"; then
+    echo '[cluster-release] capacity controller preflight failed; restoring exact deployment snapshot' >&2
+    restore_application_deployments "$deployment_snapshot" || true
+    rm -f -- "$deployment_snapshot" "$current_file"
+    return 1
+  fi
   if [[ $action == rollback ]]; then
     # Historical API images may predate the capacity-controller process role.
     # Rollbacks therefore restore static Worker replicas and leave the