fix: YAML-first 治理 CI/CD target (#919)

* docs: specify cicd yaml target governance

* fix: resolve cicd targets from yaml

---------

Co-authored-by: Codex <codex@noreply.local>

scripts/src/artifact-registry/compose-deploy.ts

@@ -1,4 +1,5 @@
 // SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. compose-deploy module for scripts/src/artifact-registry.ts.
+// SPEC: PJ2026-01060308 cicd-yaml-targets draft-2026-06-25-cicd-yaml-targets.
 
 // Moved mechanically from scripts/src/artifact-registry.ts:2579-3153 for #903.
 
@@ -23,7 +24,7 @@ import {
 import { d601K3sGuardShellLines } from "../d601-k3s-guard";
 import { composeRuntimeEnvValue } from "../runtime-env";
 
-import type { ArtifactConsumerSpec, ArtifactConsumerTarget, ArtifactRegistryOptions } from "./types";
+import { artifactRegistryOptionsTargetSummary, type ArtifactConsumerSpec, type ArtifactConsumerTarget, type ArtifactRegistryOptions } from "./types";
 import { composeArtifactEnvValues, registryArtifactMissingMessage, registryArtifactProbeScript, syntheticComposeHealthDeployScript, verifyLocalArtifactLabels } from "./artifact-probe";
 import { base64, safeName, shellQuote } from "./bundle";
 import { artifactConsumerSpecs } from "./catalog";
@@ -439,6 +440,7 @@ export function dryRunArtifactConsumerPlan(options: ArtifactRegistryOptions, spe
     error: verificationBlocked ? "runtime-verification-blocked" : undefined,
     environment,
     providerId: effectiveOptions.providerId,
+    artifactRegistryTarget: artifactRegistryOptionsTargetSummary(effectiveOptions),
     serviceId: spec.serviceId,
     commit,
     sourceRepo: sourceRepoFor(effectiveOptions, spec),