fix(worker): 拆分准入事务并收敛验收失败状态

将批量准入改为每任务独立事务，避免 P24 压测时 48 条任务共享长事务造成 transactionid 锁潮与 Worker 槽位空转。失败验收在保持 validation 的同时清理未提交任务，并记录精确压力门禁原因。统一生产 0+2 Worker 拓扑、运行时 ConfigMap 与发布配置，补充镜像预检诊断和回归测试。\n\n验证：Go 全量测试、go vet、真实 PostgreSQL 48 任务集成测试、迁移安全检查、发布脚本测试、bash -n、ShellCheck、Compose 配置均通过。

apps/api/internal/store/acceptance.go

@@ -258,7 +258,12 @@ func (s *Store) FinishAcceptanceRun(ctx context.Context, input FinishAcceptanceR
 		status = "passed"
 	}
 	report, _ := json.Marshal(sanitizeAcceptanceMetadata(sanitizeJSONForStorage(input.Report)))
-	return scanAcceptanceRun(s.pool.QueryRow(ctx, `
+	tx, err := s.pool.Begin(ctx)
+	if err != nil {
+		return AcceptanceRun{}, err
+	}
+	defer rollbackTransaction(tx)
+	run, err := scanAcceptanceRun(tx.QueryRow(ctx, `
 UPDATE gateway_acceptance_runs
 SET status = $2, report = $3::jsonb, failure_reason = NULLIF($4, ''),
     finished_at = now(), updated_at = now()
@@ -287,6 +292,23 @@ RETURNING `+acceptanceRunColumns,
 		strings.TrimSpace(input.RunID), status, report, strings.TrimSpace(input.FailureReason),
 		SystemSettingGatewayTrafficMode,
 	))
+	if err != nil {
+		return AcceptanceRun{}, err
+	}
+	cancelled := int64(0)
+	if !input.Passed {
+		cancelled, err = cancelSafeAcceptanceTasksTx(ctx, tx, run.ID)
+		if err != nil {
+			return AcceptanceRun{}, err
+		}
+	}
+	if err := tx.Commit(ctx); err != nil {
+		return AcceptanceRun{}, err
+	}
+	if cancelled > 0 {
+		s.notifyTaskAdmissionBestEffort(ctx, "*")
+	}
+	return run, nil
 }
 
 func (s *Store) RetryAcceptanceRun(ctx context.Context, runID string) (AcceptanceRun, error) {