fix: refresh v02 control plane before trigger

docs/reference/cli.md

@@ -44,7 +44,7 @@ CI/CD、GitOps、rollout、artifact 发布、PR 合并后的 DEV/PROD 滚动、P
 - `commander contract|plan --dry-run|smoke --dry-run|approval request --dry-run|prompt-lint --kind gpt55-pr` 是 host Codex 指挥官直管微服务 skeleton 入口。当前命令返回 `phase=source-contract`、service/API/state/bridge/prompt/trace/#20/#46/ClaudeQQ 审批边界、.state/commander/ 状态模型、dev 无 daemon smoke contract、dry-run 计划和 GPT-5.5 PR prompt 边界辅助 lint，不接 live bridge、不注入 prompt、不发送 ClaudeQQ。`approval request --dry-run` 会生成 200 字以内中文纯文本 ClaudeQQ 审批草案、`notification-path-unavailable` blocker 和授权后唯一可用的 `bun scripts/cli.ts microservice proxy claudeqq /api/push/text --method POST --body-json '<payload>' --raw` 命令；不得提示使用本机 ClaudeQQ skill、powershell 或本地 server。`prompt-lint` 支持 `--prompt-file` 与 `--stdin`，输出 `ok`、`missingClauses`、`riskLevel`、`suggestedPatchSnippet` 且不回显完整 prompt；它是 commander 辅助检查，不是业务 PR 门禁，也不改变 `codex submit` 默认行为。`plan`、`smoke` 与 `approval request` 必须带 `--dry-run`；缺少时返回 `error=dry-run-required`。长期规则见 `docs/reference/host-codex-commander.md`。
 - `hwlab g14 monitor-prs [--once] [--dry-run] [--interval-seconds N] [--max-cycles N] [--timeout-seconds N]` 是当前 HWLAB G14 PR -> CI/CD -> DEV rollout 的一行式入口。普通调用创建 `.state/jobs/` 异步 job 并立刻返回 `job.id`、`statusCommand` 和 stdout/stderr 路径；后台 worker 每轮通过 UniDesk `gh pr list/preflight/merge` 监控 `pikasTech/HWLAB` base=`G14` 的 open PR，ready 时合并，然后通过 UniDesk `ssh G14:k3s` 观察 `hwlab-g14-ci-poll-<short>`、Argo `hwlab-g14-dev` 和 DEV `/health/live`，直到 DEV `Synced/Healthy` 且 Deployment/StatefulSet ready；历史 `Completed` smoke/debug pod 不作为 rollout blocker。每次成功 DEV rollout 后，worker 会定位或创建 #7“指挥简报索引”中的北京日期每日简报 issue，并追加 CI/CD 耗时、CI/CD 关键指标、语义化上线 changelog、自动 diff 摘要、PipelineRun、GitOps revision 和 DEV 验证摘要；关键指标来自 G14 Tekton TaskRun results，固定包含 `lazy build reused: x/y`、reused services、rebuild services 和每个 service 的独立耗时/状态/backend，用于观察 lazy build 机制效果。语义化 changelog 优先从 PR body 的 `## 修改`/`## 变更`/`## Changelog` 等段落提取，diff 摘要只作为文件和统计证据保留，不替代 changelog。也可用 `hwlab g14 record-rollout --pr <number> --source-commit <sha>` 手动补记，手动补记同样会按 PipelineRun 采集 TaskRun 指标。状态指针按用途分离：长期监控只写 `.state/hwlab-g14/latest-monitor-job.json`，`--once` 写 `latest-once-job.json`，`--dry-run` 写 `latest-dry-run-job.json`，`--once --dry-run` 写 `latest-once-dry-run-job.json`，避免一次性收口覆盖持续监控入口。`--once --dry-run` 只做单轮监控和 merge plan，不写 GitHub、不等待 rollout。该命令禁止使用原生 `gh` 或手拼 GitHub 请求；如果 UniDesk `gh` 子命令字段或行为不够，必须先改进 `scripts/src/gh.ts` 后再使用。
 - `hwlab g14 control-plane status|apply --lane v02 [--dry-run|--confirm]` 是 HWLAB `v0.2` 加法 lane 的受控 Tekton/Argo 控制面维护入口，只面向 G14 `/root/hwlab-v02`、branch `v0.2`、namespace `hwlab-ci` 和 Argo application `hwlab-g14-v02`；`status` 只读汇总 pipeline、RBAC/ServiceAccount、Argo、当前 commit PipelineRun 和遗留 v02 CronJob 清理状态；`apply` 先在 G14 workspace 快进并执行 render check，再经 `G14:k3s` server-side apply `tekton-v02/rbac.yaml`、`pipeline.yaml`、`argocd/project.yaml` 和 `argocd/application-v02.yaml`，confirmed apply 会删除遗留 v02 CronJob，但不会应用 runtime-v02 workload、Secret 或数据迁移。
-- `hwlab g14 control-plane trigger-current --lane v02 [--dry-run|--confirm]` 是 v02 标准手动触发入口：解析当前 `origin/v0.2` full SHA，创建 commit-pinned `hwlab-v02-ci-poll-<short12>` PipelineRun；读 Git 走 `git-mirror-http.devops-infra.svc.cluster.local`，GitOps promotion 写 `git-mirror-write.devops-infra.svc.cluster.local`；同名 PipelineRun 成功或运行中时拒绝重复触发，失败或不存在时才删除旧对象并重新创建。
+- `hwlab g14 control-plane trigger-current --lane v02 [--dry-run|--confirm]` 是 v02 标准手动触发入口：解析当前 `origin/v0.2` full SHA，创建 commit-pinned `hwlab-v02-ci-poll-<short12>` PipelineRun；读 Git 走 `git-mirror-http.devops-infra.svc.cluster.local`，GitOps promotion 写 `git-mirror-write.devops-infra.svc.cluster.local`；confirmed trigger 在删除/创建 PipelineRun 前会先按当前 source commit render 并 server-side apply v02 Tekton RBAC、Pipeline 与 Argo Application，避免 CI/CD 脚本或 runtime-ready 逻辑已合并但集群仍执行旧 Pipeline 定义；同名 PipelineRun 成功或运行中时拒绝重复触发，失败或不存在时才删除旧对象并重新创建。
   创建 PipelineRun 前会读取 `devops-infra` mirror refs，若 `localV02` 未等于当前 source commit，则自动执行一次受控 manual `git-mirror sync` Job 并复核 ref，复核失败时停止触发，避免 Tekton `prepare-source` 已知失败；services 参数只包含 v02 runtime service matrix，`hwlab-cli` 是固定 repo 短连接源码工具，不进入 PipelineRun service build。
   `--dry-run` 只报告是否会 pre-sync，不创建 Job；confirmed trigger 默认创建 `.state/jobs/` 异步 job 并立刻返回 `job.id`、`statusCommand`、stdout/stderr 路径，避免 git mirror pre-sync 或 PipelineRun 创建期间长时间无输出；只有现场同步调试才显式加 `--wait`；旧 `rerun-current` 只作为输入别名保留。
 - `hwlab g14 control-plane runtime-migration --lane v02 [--dry-run|--allow-live-db-read --dry-run|--confirm]` 只通过 `hwlab-v02` namespace 当前 `deployment/hwlab-cloud-api -c hwlab-cloud-api` 内 repo-owned migration CLI 执行；不读取或打印 Secret 值、不触碰 PROD、不绕到手工 `psql`。

scripts/src/hwlab-g14.ts

@@ -751,6 +751,36 @@ function applyV02ControlPlaneFiles(sourceCommit: string, dryRun: boolean, timeou
   ], timeoutSeconds * 1000);
 }
 
+function refreshV02ControlPlaneBeforeTrigger(sourceCommit: string, timeoutSeconds: number): Record<string, unknown> {
+  const renderCheck = runV02RenderCheck(sourceCommit);
+  if (!isCommandSuccess(renderCheck)) {
+    return {
+      ok: false,
+      phase: "source-render-check",
+      sourceCommit,
+      renderDir: v02RenderDir(sourceCommit),
+      renderCheck,
+      degradedReason: "control-plane-render-check-failed",
+    };
+  }
+  const apply = applyV02ControlPlaneFiles(sourceCommit, false, timeoutSeconds);
+  const cleanupObsoleteCronJobs = isCommandSuccess(apply) ? deleteV02ObsoleteCronJobs(false) : null;
+  return {
+    ok: isCommandSuccess(apply) && (cleanupObsoleteCronJobs === null || isCommandSuccess(cleanupObsoleteCronJobs)),
+    phase: "control-plane-refresh",
+    sourceCommit,
+    renderDir: v02RenderDir(sourceCommit),
+    renderCheck: commandData(renderCheck),
+    apply,
+    cleanupObsoleteCronJobs,
+    degradedReason: !isCommandSuccess(apply)
+      ? "control-plane-apply-failed"
+      : cleanupObsoleteCronJobs !== null && !isCommandSuccess(cleanupObsoleteCronJobs)
+        ? "obsolete-cronjob-cleanup-failed"
+        : undefined,
+  };
+}
+
 function getV02ObsoleteCronJobs(): CommandJsonResult {
   return g14K3s([
     "kubectl",
@@ -959,6 +989,11 @@ function runV02ControlPlane(options: G14ControlPlaneOptions): Record<string, unk
       pipelineRun: v02PipelineRunName(sourceCommit),
       before,
       gitMirrorPreSync,
+      controlPlaneRefresh: {
+        mode: "skipped-dry-run",
+        wouldRefreshBeforeCreate: true,
+        resources: ["tekton-v02/rbac.yaml", "tekton-v02/pipeline.yaml", "argocd/project.yaml", "argocd/application-v02.yaml"],
+      },
       manifest: v02PipelineRunManifest(sourceCommit),
       next: { triggerCurrent: "bun scripts/cli.ts hwlab g14 control-plane trigger-current --lane v02 --confirm" },
     };
@@ -975,6 +1010,21 @@ function runV02ControlPlane(options: G14ControlPlaneOptions): Record<string, unk
       degradedReason: "refuse-active-or-successful-pipelinerun",
     };
   }
+  const controlPlaneRefresh = refreshV02ControlPlaneBeforeTrigger(sourceCommit, options.timeoutSeconds);
+  if (controlPlaneRefresh.ok !== true) {
+    return {
+      ok: false,
+      command: "hwlab g14 control-plane trigger-current --lane v02",
+      lane: "v02",
+      mode: "confirmed-trigger",
+      phase: "control-plane-refresh",
+      sourceCommit,
+      pipelineRun: v02PipelineRunName(sourceCommit),
+      before,
+      controlPlaneRefresh,
+      degradedReason: record(controlPlaneRefresh).degradedReason ?? "control-plane-refresh-failed",
+    };
+  }
   const gitMirrorPreSync = preSyncV02GitMirror(sourceCommit, options);
   if (gitMirrorPreSync.ok !== true) {
     return {
@@ -986,6 +1036,7 @@ function runV02ControlPlane(options: G14ControlPlaneOptions): Record<string, unk
       sourceCommit,
       pipelineRun: v02PipelineRunName(sourceCommit),
       before,
+      controlPlaneRefresh,
       gitMirrorPreSync,
       degradedReason: "git-mirror-pre-sync-failed",
     };
@@ -1002,6 +1053,7 @@ function runV02ControlPlane(options: G14ControlPlaneOptions): Record<string, unk
     sourceCommit,
     pipelineRun: v02PipelineRunName(sourceCommit),
     before,
+    controlPlaneRefresh,
     gitMirrorPreSync,
     deletePipelineRun,
     createPipelineRun,