refactor(release): 改为 Agent 双阶段人工发布

删除 Gitea Actions、Tag/Main 自动流水线和旧 Runner 配置，取消 Git 操作与发布授权的绑定。\n\n新增本地镜像发布、固定生产部署助手、digest manifest、迁移安全检查、simulation 冒烟及显式回滚流程。\n\n验证：pnpm lint、pnpm test、pnpm build、Go 全量测试、ShellCheck、Compose 配置、人工发布测试和 linux/amd64 完整栈冒烟。

scripts/deploy-compose.sh

@@ -6,7 +6,7 @@ COMPOSE_FILE="${COMPOSE_FILE:-docker-compose.yml}"
 COMPOSE_PROJECT_NAME="${COMPOSE_PROJECT_NAME:-easyai-ai-gateway}"
 AI_GATEWAY_PLATFORM="${AI_GATEWAY_PLATFORM:-linux/amd64}"
 AI_GATEWAY_IMAGE_REGISTRY="${AI_GATEWAY_IMAGE_REGISTRY:-registry.cn-shanghai.aliyuncs.com/easyaigc}"
-AI_GATEWAY_IMAGE_TAG="${AI_GATEWAY_IMAGE_TAG:-latest}"
+AI_GATEWAY_IMAGE_TAG="${AI_GATEWAY_IMAGE_TAG:-local}"
 AI_GATEWAY_API_IMAGE="${AI_GATEWAY_API_IMAGE:-${AI_GATEWAY_IMAGE_REGISTRY}/ai-gateway:${AI_GATEWAY_IMAGE_TAG}}"
 AI_GATEWAY_WEB_IMAGE="${AI_GATEWAY_WEB_IMAGE:-${AI_GATEWAY_IMAGE_REGISTRY}/ai-gateway-web:${AI_GATEWAY_IMAGE_TAG}}"
 ACTION="${1:-deploy}"
@@ -22,11 +22,8 @@ compose=(docker compose -f "$COMPOSE_FILE")
 usage() {
   cat <<'EOF'
 Usage:
-  scripts/deploy-compose.sh          Build, migrate, start, and verify
+  scripts/deploy-compose.sh          Build, migrate, start, and verify locally
   scripts/deploy-compose.sh deploy   Same as default
-  scripts/deploy-compose.sh push     Build and push API/Web images
-  scripts/deploy-compose.sh push-only
-                                    Push already-built API/Web images
   scripts/deploy-compose.sh down     Stop containers, keep volumes
   scripts/deploy-compose.sh clean    Stop containers and remove volumes
 
@@ -38,8 +35,10 @@ Useful environment overrides:
   AI_GATEWAY_WEB_PORT=5178
   AI_GATEWAY_API_PORT=8088
   AI_GATEWAY_DB_PORT=54329
-  AI_GATEWAY_PUSH=1
   AI_GATEWAY_SKIP_BUILD=1
+
+Production publishing is intentionally unavailable here. Use:
+  scripts/publish-release-images.sh --components auto
 EOF
 }
 
@@ -125,86 +124,6 @@ build_images() {
   fi
 }
 
-package_version() {
-  local version=""
-
-  version="$(
-    sed -nE 's/^[[:space:]]*"version"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/p' "$PROJECT_ROOT/package.json" \
-      | head -n 1
-  )"
-  if [[ -z "$version" ]]; then
-    echo "[ai-gateway] cannot infer package version from package.json; set AI_GATEWAY_IMAGE_TAG" >&2
-    exit 1
-  fi
-  echo "$version"
-}
-
-push_version_tag() {
-  if [[ "$AI_GATEWAY_IMAGE_TAG" == "latest" ]]; then
-    package_version
-  else
-    echo "$AI_GATEWAY_IMAGE_TAG"
-  fi
-}
-
-image_repository() {
-  local image="$1"
-  echo "${image%:*}"
-}
-
-tag_release_images() {
-  local version_tag="$1"
-  local api_repo web_repo
-  local api_version_image api_latest_image web_version_image web_latest_image
-
-  api_repo="$(image_repository "$AI_GATEWAY_API_IMAGE")"
-  web_repo="$(image_repository "$AI_GATEWAY_WEB_IMAGE")"
-  api_version_image="${api_repo}:${version_tag}"
-  api_latest_image="${api_repo}:latest"
-  web_version_image="${web_repo}:${version_tag}"
-  web_latest_image="${web_repo}:latest"
-
-  docker image inspect "$AI_GATEWAY_API_IMAGE" >/dev/null 2>&1 || {
-    echo "[ai-gateway] missing local API image: ${AI_GATEWAY_API_IMAGE}; build it first" >&2
-    exit 1
-  }
-  docker image inspect "$AI_GATEWAY_WEB_IMAGE" >/dev/null 2>&1 || {
-    echo "[ai-gateway] missing local Web image: ${AI_GATEWAY_WEB_IMAGE}; build it first" >&2
-    exit 1
-  }
-
-  docker tag "$AI_GATEWAY_API_IMAGE" "$api_version_image"
-  docker tag "$AI_GATEWAY_API_IMAGE" "$api_latest_image"
-  docker tag "$AI_GATEWAY_WEB_IMAGE" "$web_version_image"
-  docker tag "$AI_GATEWAY_WEB_IMAGE" "$web_latest_image"
-
-  RELEASE_IMAGES=(
-    "$api_version_image"
-    "$api_latest_image"
-    "$web_version_image"
-    "$web_latest_image"
-  )
-}
-
-push_images() {
-  local version_tag
-  local image
-
-  version_tag="$(push_version_tag)"
-  echo "[ai-gateway] release image tag: ${version_tag}"
-  echo "[ai-gateway] latest tag will also be pushed"
-  tag_release_images "$version_tag"
-
-  for image in "${RELEASE_IMAGES[@]}"; do
-    echo "[ai-gateway] pushing image: ${image}"
-    if ! docker push "$image"; then
-      echo "[ai-gateway] failed to push image; login may be required:" >&2
-      echo "[ai-gateway] docker login --username=<your-aliyun-account> registry.cn-shanghai.aliyuncs.com" >&2
-      exit 1
-    fi
-  done
-}
-
 deploy() {
   cd "$PROJECT_ROOT"
 
@@ -227,10 +146,6 @@ deploy() {
 
   build_images
 
-  if [[ "${AI_GATEWAY_PUSH:-0}" == "1" ]]; then
-    push_images
-  fi
-
   echo "[ai-gateway] starting postgres"
   "${compose[@]}" up -d postgres
   wait_for_service_healthy postgres
@@ -262,15 +177,6 @@ case "$ACTION" in
   deploy|up)
     deploy
     ;;
-  push)
-    cd "$PROJECT_ROOT"
-    build_images
-    push_images
-    ;;
-  push-only)
-    cd "$PROJECT_ROOT"
-    push_images
-    ;;
   down)
     cd "$PROJECT_ROOT"
     "${compose[@]}" down --remove-orphans