fix: YAML-first 治理 CI/CD target (#919)

* docs: specify cicd yaml target governance

* fix: resolve cicd targets from yaml

---------

Co-authored-by: Codex <codex@noreply.local>

scripts/src/artifact-registry/readonly.ts

@@ -1,4 +1,5 @@
 // SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. readonly module for scripts/src/artifact-registry.ts.
+// SPEC: PJ2026-01060308 cicd-yaml-targets draft-2026-06-25-cicd-yaml-targets.
 
 // Moved mechanically from scripts/src/artifact-registry.ts:1934-2116 for #903.
 
@@ -23,7 +24,7 @@ import {
 import { d601K3sGuardShellLines } from "../d601-k3s-guard";
 import { composeRuntimeEnvValue } from "../runtime-env";
 
-import type { ArtifactRegistryCommandRuntime, ArtifactRegistryOptions, ArtifactRegistryReadonlyProbe } from "./types";
+import { artifactRegistryOptionsTargetSummary, type ArtifactRegistryCommandRuntime, type ArtifactRegistryOptions, type ArtifactRegistryReadonlyProbe } from "./types";
 import { renderBundle } from "./bundle";
 import { commandTail } from "./consumer";
 import { annotateRemoteFirstReadonlyResult, annotateRemoteReadonlyResult, controlPlaneMissingResult, parsedCliData, readonlyCommandFailureResult, remoteFrontendHostFromEnv, runRemoteScript, unwrapRemoteArtifactRegistryResult } from "./remote";
@@ -41,7 +42,7 @@ export function artifactRegistryReadonlyAutoRemotePlan(
     providerId: options.providerId,
     host: remoteHost,
     transport: "frontend",
-    command: remoteHost === null ? null : `bun scripts/cli.ts --main-server-ip ${remoteHost} artifact-registry ${action} --provider-id ${options.providerId}`,
+    command: remoteHost === null ? null : `bun scripts/cli.ts --main-server-ip ${remoteHost} artifact-registry ${action} --target ${options.targetId}`,
     failureClassification: remoteHost === null ? "control-plane-missing" : null,
   };
 }
@@ -81,8 +82,8 @@ export function runReadonlyStatusViaRemoteFrontend(
     remoteHost,
     "artifact-registry",
     action,
-    "--provider-id",
-    options.providerId,
+    "--target",
+    options.targetId,
     "--timeout-ms",
     String(options.timeoutMs),
   ];
@@ -146,6 +147,7 @@ export function statusFromValues(options: ArtifactRegistryOptions, values: Recor
     installed,
     healthy,
     ...decision,
+    target: artifactRegistryOptionsTargetSummary(options),
     remoteCommandShape: readonlyRemoteCommandShape(healthMode ? "health" : "status", options),
     checks,
     observed: {