feat: expand ci artifact catalog

scripts/src/deploy.ts

@@ -139,6 +139,7 @@ const devApplySupportedServiceIds = new Set<string>(["backend-core"]);
 const devArtifactConsumerServiceIds = new Set<string>(["baidu-netdisk", "code-queue-mgr", "decision-center", "frontend", "oa-event-flow", "project-manager", "todo-note"]);
 const devArtifactConsumerProdDesiredFallbackServiceIds = new Set<string>(["code-queue-mgr", "oa-event-flow", "project-manager", "todo-note"]);
 const prodArtifactConsumerServiceIds = new Set<string>(["backend-core", "baidu-netdisk", "code-queue-mgr", "decision-center", "frontend", "oa-event-flow", "project-manager", "todo-note"]);
+const prodForbiddenTargetSideBuildServiceIds = new Set<string>(["backend-core", "baidu-netdisk", "decision-center", "frontend"]);
 const prodArtifactLiveApplyBlockedServiceIds = new Map<string, string>([
   ["code-queue-mgr", "code-queue-mgr is the main-server Code Queue control-plane sidecar; live production apply requires explicit supervisor confirmation."],
   ["todo-note", "todo-note source is external to this repository and the current checked-in contract cannot prove /api/health deploy.commit/deploy.requestedCommit support."],
@@ -2700,6 +2701,22 @@ function prodArtifactUnsupportedResult(services: DeployManifestService[]): Recor
   };
 }
 
+function prodArtifactConsumerLocalManifestResult(services: DeployManifestService[]): Record<string, unknown> {
+  return {
+    ok: false,
+    supported: false,
+    error: "prod-artifact-consumer-local-manifest-blocked",
+    services: services.map((service) => ({
+      id: service.id,
+      repo: service.repo,
+      commitId: service.commitId,
+      replacement: `bun scripts/cli.ts deploy apply --env prod --service ${service.id} --commit ${service.commitId}`,
+      reason: "production artifact consumers must use the Git-backed environment manifest and D601 registry artifact consumer, not local-manifest target-side source build",
+    })),
+    policy: "prod deploy must not silently fall back to a dirty worktree, local manifest, target-side source build, or maintenance-channel deployment",
+  };
+}
+
 function prodArtifactLiveApplyBlockedResult(services: DeployManifestService[]): Record<string, unknown> {
   return {
     ok: false,