fix: expose pac sentinel cicd diagnosis

.agents/skills/unidesk-cicd/references/control-plane.md

@@ -80,3 +80,5 @@ runtime base image 走 `config/hwlab-node-lanes.yaml`：`baseImageSource` 是公
 PipelineRun 失败或长时间未完成时，先按定点 `control-plane status --pipeline-run <name>` 和 bounded 只读诊断定位失败 TaskRun/Pod/container。env-reuse service build 常见失败点是 `build-<service>` 的 `step-publish` 日志；先用 `platform-infra sub2api status|validate` 区分共享 proxy 整体故障和单个上游 transient。proxy 健康但单个依赖下载 transient 时，可以受控 `trigger-current --rerun`；重复失败应修 `artifact-publish`/envRecipe 的有限 retry 后重新合并发布。
 
 小范围 PR 触发 120s 时必须看 plan artifacts 的 `affectedServices/buildServices/reusedServices`：如果 source diff 很小却出现所有 envreuse 服务都在 `buildServices` 且 `reusedServices=[]`，优先怀疑 current GitOps artifact catalog 没有 hydrate 到 source plan 阶段，而不是继续盲目重跑 PipelineRun。
+
+Web 哨兵 control-plane 出现 registry half-state、GitOps 超预算或异步 git-mirror flush 时，先看默认 `DRILLDOWN` 表。PipelineRun/TaskRun 细节走 `platform-infra pipelines-as-code history --id`，registry tag 走 `web-probe sentinel image status`，GitOps flush 走受控 `hwlab nodes git-mirror status|flush` 或 async job status；不要回退到裸 `kubectl/tkn/argo` 或解析原生命令输出。

.agents/skills/unidesk-cicd/references/gitea-pac.md

@@ -34,6 +34,8 @@ Use `bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 -
 
 Do not use `cicd branch-follower status` to decide whether the three migrated JD01 consumers are current. It is historical/migration-only and may contain stale state from before PaC cutover.
 
+For migrated sentinel CI/CD half-state triage, the PaC `status` command owns the source/registry/GitOps/Argo/runtime diagnosis. It must classify registry-missing, GitOps-missing, Argo-pending and runtime-mismatch states from target-side short probes, using YAML-declared probe endpoints such as `registry_probe_base`; do not reintroduce old control-plane status as the primary architecture or use registry manifest `HEAD` as the readiness check.
+
 ## Reuse Interpretation
 
 - AgentRun `IMAGE_STATUS=reused` means the image build was skipped or registry artifact was reused for the same env identity.