docs: freeze cicd special-case boundaries

scripts/src/docker.ts

@@ -27,6 +27,56 @@ export function isRebuildableService(value: string | undefined): value is Rebuil
   return rebuildableServices.some((service) => service === value);
 }
 
+export function unsupportedRebuildService(value: string | undefined): Record<string, unknown> {
+  const service = value ?? null;
+  const classifications: Record<string, Record<string, unknown>> = {
+    database: {
+      classification: "upstream-digest",
+      reason: "database uses the upstream postgres:16-alpine image and a named PGDATA volume; it is not a source-built UniDesk service",
+      replacement: "use server start/stop for lifecycle only; database image pin/mirror policy belongs to the upstream image precheck",
+      deleteAllowedLater: false,
+    },
+    filebrowser: {
+      classification: "upstream-digest",
+      reason: "filebrowser is an upstream image consumer pinned by digest/mirror policy, not a Dockerfile source-build service",
+      replacement: "future pull-only upstream digest CD; current provider-local docker-run repair remains maintenance-only",
+      deleteAllowedLater: false,
+    },
+    "filebrowser-d601": {
+      classification: "upstream-digest",
+      reason: "filebrowser-d601 is an upstream image consumer pinned by digest/mirror policy, not a Dockerfile source-build service",
+      replacement: "future pull-only upstream digest CD; current provider-local docker-run repair remains maintenance-only",
+      deleteAllowedLater: false,
+    },
+    "code-queue": {
+      classification: "standard-artifact",
+      reason: "code-queue execution plane is D601 k3s-managed and only supports the dev artifact consumer in this phase",
+      replacement: "deploy apply --env dev --service code-queue or artifact-registry deploy-service --env dev --service code-queue",
+      deleteAllowedLater: false,
+    },
+    "k3sctl-adapter": {
+      classification: "bootstrap-keep",
+      reason: "k3sctl-adapter is a D601 control bridge outside the main-server Compose stack",
+      replacement: "keep direct bridge repair and artifact plan/dry-run; live prod apply requires supervisor confirmation",
+      deleteAllowedLater: false,
+    },
+  };
+  return {
+    ok: false,
+    supported: false,
+    error: "unsupported-server-rebuild",
+    service,
+    ...(typeof value === "string" && classifications[value] !== undefined ? classifications[value] : {
+      classification: "needs-manual",
+      reason: "server rebuild can mutate only reviewed main-server Docker Compose services",
+      replacement: "inspect config.json, deploy.json, and docs/reference/cicd-standardization.md before choosing a release or maintenance path",
+      deleteAllowedLater: false,
+    }),
+    allowedServices: [...rebuildableServices],
+    policy: "server rebuild is a bootstrap/maintenance entrypoint and must not silently fall back to source builds for upstream images, D601 services, database, or unknown objects",
+  };
+}
+
 export function resolveComposeCommand(config: UniDeskConfig, envFile: string): string[] {
   const composeFile = rootPath(config.docker.composeFile);
   if (commandOk(["docker", "compose", "version"], repoRoot)) {