chore: add cicd legacy cleanup precheck

scripts/src/deploy.ts

@@ -138,6 +138,7 @@ const d601MaintenanceDeployAllowedServiceIds = new Set<string>(["backend-core",
 const devApplySupportedServiceIds = new Set<string>(["backend-core"]);
 const devArtifactConsumerServiceIds = new Set<string>(["baidu-netdisk", "decision-center", "frontend"]);
 const prodArtifactConsumerServiceIds = new Set<string>(["backend-core", "baidu-netdisk", "decision-center", "frontend"]);
+const prodForbiddenTargetSideBuildServiceIds = prodArtifactConsumerServiceIds;
 const deployEnvironmentTargets: Record<DeployEnvironment, DeployEnvironmentTarget> = {
   dev: {
     environment: "dev",
@@ -2671,6 +2672,23 @@ function prodArtifactUnsupportedResult(services: DeployManifestService[]): Recor
   };
 }
 
+function prodArtifactConsumerLocalManifestResult(services: DeployManifestService[]): Record<string, unknown> {
+  return {
+    ok: false,
+    supported: false,
+    error: "prod-artifact-consumer-local-manifest-blocked",
+    services: services.map((service) => ({
+      id: service.id,
+      repo: service.repo,
+      commitId: service.commitId,
+      supported: true,
+      reason: "This service has a reviewed artifact consumer; production source-build deploy from a local manifest is blocked.",
+    })),
+    policy: "prod artifact consumers must enter through deploy apply --env prod so CD consumes an existing commit-pinned registry image and never falls back to source build or a dirty worktree",
+    commandShape: "bun scripts/cli.ts deploy apply --env prod --service <service-id> --commit <full-sha>",
+  };
+}
+
 async function runArtifactConsumerApplyNow(
   manifest: DeployManifest,
   options: DeployOptions,
@@ -2830,6 +2848,9 @@ export async function runDeployCommand(config: UniDeskConfig | null, args: strin
   if (config === null) throw new Error("deploy local manifest mode requires config.json");
   const manifest = resolveManifestCommits(await readDeployManifest(options.file), options.serviceId);
   if (action === "check" || action === "plan") return await checkOrPlan(config, manifest, options, action);
+  const prodArtifactConsumers = selectedEnvironmentServices(manifest, options.serviceId)
+    .filter((service) => manifest.environment !== "dev" && prodForbiddenTargetSideBuildServiceIds.has(service.id));
+  if (prodArtifactConsumers.length > 0) return prodArtifactConsumerLocalManifestResult(prodArtifactConsumers);
   if (!options.dryRun) {
     const blocked = blockedD601MaintenanceDeployServices(config, manifest, options.serviceId);
     if (blocked.length > 0) throw new Error(d601MaintenanceDeployBlockMessage(blocked));