fix: YAML-first 治理 CI/CD target (#919)

* docs: specify cicd yaml target governance

* fix: resolve cicd targets from yaml

---------

Co-authored-by: Codex <codex@noreply.local>

config/artifact-registry.yaml

@@ -0,0 +1,63 @@
+# SPEC: PJ2026-01060308 cicd-yaml-targets draft-2026-06-25-cicd-yaml-targets.
+version: 1
+kind: UnideskArtifactRegistry
+metadata:
+  name: unidesk-artifact-registry
+  owner: unidesk
+
+defaults:
+  targetId: D601
+
+targets:
+  D601:
+    providerId: D601
+    mode: d601-host-managed
+    registry:
+      host: 127.0.0.1
+      port: 5000
+      endpoint: http://127.0.0.1:5000
+      image: registry:2.8.3
+      repositoryPrefix: 127.0.0.1:5000/unidesk
+    runtime:
+      baseDir: /home/ubuntu/.unidesk/artifact-registry
+      storageDir: /home/ubuntu/.unidesk/registry-storage
+      unitName: unidesk-artifact-registry.service
+      composeProject: unidesk-artifact-registry
+      serviceName: registry
+      containerName: unidesk-artifact-registry
+      timeoutMs: 30000
+    source:
+      repo: https://github.com/pikasTech/unidesk
+    consumers:
+      target:
+        composePullMode: provider-gateway-image-stream
+        k3sImportMode: d601-native-containerd
+        defaultEnvironment: prod
+      catalogRef: scripts/src/artifact-registry/catalog.ts
+      note: catalogRef is a legacy adapter boundary until service manifests own each consumer.
+  local:
+    providerId: local
+    mode: d601-host-managed-local
+    registry:
+      host: 127.0.0.1
+      port: 5000
+      endpoint: http://127.0.0.1:5000
+      image: registry:2.8.3
+      repositoryPrefix: 127.0.0.1:5000/unidesk
+    runtime:
+      baseDir: /home/ubuntu/.unidesk/artifact-registry
+      storageDir: /home/ubuntu/.unidesk/registry-storage
+      unitName: unidesk-artifact-registry.service
+      composeProject: unidesk-artifact-registry
+      serviceName: registry
+      containerName: unidesk-artifact-registry
+      timeoutMs: 30000
+    source:
+      repo: https://github.com/pikasTech/unidesk
+    consumers:
+      target:
+        composePullMode: provider-gateway-image-stream
+        k3sImportMode: d601-native-containerd
+        defaultEnvironment: prod
+      catalogRef: scripts/src/artifact-registry/catalog.ts
+      note: local target reuses the D601 host registry facts when the CLI runs on the target host.

config/cicd/targets.yaml

@@ -0,0 +1,35 @@
+# SPEC: PJ2026-01060308 cicd-yaml-targets draft-2026-06-25-cicd-yaml-targets.
+version: 1
+kind: UnideskCicdTargets
+metadata:
+  name: unidesk-cicd-targets
+  owner: unidesk
+
+defaults:
+  targetId: D601
+
+targets:
+  D601:
+    providerId: D601
+    kubeRoute: D601:k3s
+    kubeconfig: /etc/rancher/k3s/k3s.yaml
+    hostCwd: /home/ubuntu
+    homeDir: /home/ubuntu
+    pipelineManifest: src/components/microservices/k3sctl-adapter/k3s/ci/unidesk-ci.pipeline.yaml
+    codeQueueImage: unidesk-code-queue:dev
+    guardName: d601_native_k3s_guard
+    requiredNodeName: d601
+    artifactRegistry:
+      configRef: config/artifact-registry.yaml#targets.D601
+  G14:
+    providerId: G14
+    kubeRoute: G14:k3s
+    kubeconfig: /etc/rancher/k3s/k3s.yaml
+    hostCwd: /root
+    homeDir: /root
+    pipelineManifest: src/components/microservices/k3sctl-adapter/k3s/ci/unidesk-ci.pipeline.g14.yaml
+    codeQueueImage: unidesk-code-queue:dev
+    guardName: g14_native_k3s_guard
+    requiredNodeLabel:
+      key: unidesk.ai/node-id
+      value: G14

config/hwlab-node-lanes.yaml

@@ -120,6 +120,7 @@ lanes:
         deployment: hwlab-cloud-api
     targets:
       D601:
+        node: D601
         workspace: /home/ubuntu/workspace/hwlab-v03
         cicdRepo: /home/ubuntu/workspace/hwlab-v03-cicd.git
         cicdRepoLock: /tmp/hwlab-v03-cicd-repo.lock

config/platform-infra/observability.yaml

@@ -64,9 +64,10 @@ instrumentation:
   serviceConnections:
     - serviceName: hwlab-cloud-api
       owningRepo: pikasTech/HWLAB
-      targetNode: D601
-      lane: v0.3
-      namespace: hwlab-v03
+      configRefs:
+        targetNode: config/hwlab-node-lanes.yaml#lanes.v03.targets.D601.node
+        lane: config/hwlab-node-lanes.yaml#lanes.v03.version
+        namespace: config/hwlab-node-lanes.yaml#lanes.v03.targets.D601.runtime.namespace
       requiredSpans:
         - POST /v1/agent/chat
         - durable_admission
@@ -77,16 +78,18 @@ instrumentation:
         - turn_status_read
     - serviceName: user-billing
       owningRepo: pikasTech/HWLAB
-      targetNode: D601
-      lane: v0.3
-      namespace: hwlab-v03
+      configRefs:
+        targetNode: config/hwlab-node-lanes.yaml#lanes.v03.targets.D601.node
+        lane: config/hwlab-node-lanes.yaml#lanes.v03.version
+        namespace: config/hwlab-node-lanes.yaml#lanes.v03.targets.D601.runtime.namespace
       requiredSpans:
         - billing_preflight
     - serviceName: agentrun-manager
       owningRepo: pikasTech/agentrun
-      targetNode: D601
-      lane: v0.2
-      namespace: agentrun-v02
+      configRefs:
+        targetNode: config/agentrun.yaml#controlPlane.lanes.v02.node
+        lane: config/agentrun.yaml#controlPlane.lanes.v02.version
+        namespace: config/agentrun.yaml#controlPlane.lanes.v02.runtime.namespace
       requiredSpans:
         - agentrun_dispatch
         - run_created