feat: add d601 dev environment foundation

scripts/cli.ts

@@ -16,6 +16,7 @@ import { runScheduleCommand } from "./src/schedules";
 import { parseNetworkPerfOptions, runNetworkPerf } from "./src/network-perf";
 import { runCiCommand } from "./src/ci";
 import { runSwapCommand } from "./src/swap";
+import { runDevEnvCommand } from "./src/dev-env";
 
 const remoteOptions = extractRemoteCliOptions(process.argv.slice(2));
 const args = remoteOptions.args;
@@ -54,6 +55,7 @@ function help(): unknown {
       { command: "decision list [--type ...] [--status ...] [--level ...] [--linked-goal-id id] [--limit N]", description: "List Decision Center records through the user-service proxy." },
       { command: "decision show <id>", description: "Show one Decision Center record." },
       { command: "deploy check|plan|apply [--file deploy.json|--env dev|prod] [--service id] [--dry-run] [--force]", description: "Reconcile services from a repo+commit manifest; --env uses fixed environment refs for dry-run planning in Phase 0." },
+      { command: "dev-env validate [--manifest path] [--kubectl-dry-run]", description: "Validate the D601 unidesk-dev namespace/database foundation manifest and production DB URL guardrails without applying resources." },
       { command: "schedule list|get|runs|run|delete", description: "Manage backend-core scheduled tasks and run history; schedule run <id> supports --wait-ms N." },
       { command: "schedule upsert-pgdata-backup [--time HH:MM] [--remote-base /SERVER_DATA/UNIDESK_PG_DATA]", description: "Create or update the daily PGDATA physical backup task that uploads monthly rotated archives to Baidu Netdisk." },
       { command: "codex deploy <commitId> [--provider-id D601] [--timeout-ms N]", description: "Compatibility wrapper for deploy apply --service code-queue with a temporary repo+commit manifest." },
@@ -155,6 +157,14 @@ async function main(): Promise<void> {
     return;
   }
 
+  if (top === "dev-env") {
+    const result = runDevEnvCommand(args.slice(1));
+    const ok = (result as { ok?: unknown }).ok !== false;
+    emitJson(commandName, result, ok);
+    if (!ok) process.exitCode = 1;
+    return;
+  }
+
   const config = readConfig();
 
   if (top === "ssh") {