chore: add cicd legacy cleanup precheck

scripts/src/ci.ts

@@ -204,6 +204,9 @@ function requireSupportedUserService(config: UniDeskConfig, serviceId: string):
   }
   const service = config.microservices.find((item) => item.id === serviceId);
   if (service === undefined) throw new Error(`unknown user service: ${serviceId}`);
+  if (service.repository.artifactSource?.kind === "upstream-image") {
+    throw new Error(`ci publish-user-service does not build ${serviceId}: it is an upstream image consumer (${service.repository.artifactSource.imageRef}). Use the upstream-image digest/mirror governance path; do not add it to Dockerfile CI artifacts.`);
+  }
   const isD601K3sService = service.providerId === d601ProviderId
     && service.development.providerId === d601ProviderId
     && service.deployment.mode === "k3sctl-managed";
@@ -1123,7 +1126,7 @@ async function publishBackendCoreArtifact(config: UniDeskConfig, options: CiPubl
     condition,
     next: [
       `bun scripts/cli.ts ci logs ${name}`,
-      `bun scripts/cli.ts artifact-registry deploy-backend-core --commit ${options.commit}`,
+      `bun scripts/cli.ts deploy apply --env prod --service backend-core --commit ${options.commit}`,
     ],
   };
 }
@@ -1473,7 +1476,7 @@ export function ciHelp(): Record<string, unknown> {
     backendCoreArtifact: {
       producer: "D601 CI",
       registry: "127.0.0.1:5000/unidesk/backend-core:<commit>",
-      cdCommand: "bun scripts/cli.ts artifact-registry deploy-backend-core --commit <full-sha>",
+      cdCommand: "bun scripts/cli.ts deploy apply --env prod --service backend-core --commit <full-sha>",
     },
     userServiceArtifact: {
       producer: "D601 CI",