feat(agentrun): 上线 nc01-release 生产 runtime 与 PaC 声明

为 #2154 完成 R3–R5：PaC/Gitea consumer、独立 DB/Secret、agentrun-release
manager 健康上线；GitOps 自动链与 HWLAB 绑定仍待后续。

config/platform-infra/gitea.yaml

@@ -244,6 +244,27 @@ sourceAuthority:
         readUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/agentrun.git
         configRef: config/cicd-branch-followers.yaml#followers.agentrun-nc01-v02.nativeStatus.source.gitMirrorReadUrl
         disposition: replaced-by-gitea
+    - key: agentrun-nc01-release
+      targetId: NC01
+      upstream:
+        repository: pikasTech/agentrun
+        cloneUrl: https://github.com/pikasTech/agentrun.git
+        branch: release
+      gitea:
+        owner: mirrors
+        name: pikasTech-agentrun
+        mirrorMode: controlled-push
+        publicRead: true
+        readUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
+      gitops:
+        branch: nc01-release-gitops
+        flushDisposition: retained-for-gitops-flush
+      snapshot:
+        naming: agentrun-release-prefix
+        prefix: refs/unidesk/snapshots/gitea-actions/agentrun-release
+      legacyGitMirror:
+        readUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/agentrun.git
+        disposition: replaced-by-gitea
     - key: unidesk-master
       targetId: JD01
       upstream:

config/platform-infra/pipelines-as-code.yaml

@@ -147,6 +147,10 @@ repositories:
     variables:
       NODE: NC01
       LANE: v02
+  - extends: templates.repositories.agentrunRelease
+    variables:
+      NODE: NC01
+      LANE: release
   - extends: templates.repositories.sentinelV03
     variables:
       NODE: JD01
@@ -310,6 +314,27 @@ consumers:
         hostNetwork: true
         dnsPolicy: ClusterFirstWithHostNet
         fsGroup: 1000
+  - extends: templates.consumers.agentrunRelease
+    variables:
+      NODE: NC01
+      LANE: release
+    deliveryProvenance:
+      required: true
+      markerValue: admission-pac-v2:agentrun-nc01-release
+      executionServiceAccountName: agentrun-nc01-release-tekton-runner
+      gitOps:
+        repoUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/agentrun.git
+        targetRevision: nc01-release-gitops
+    sourceArtifact:
+      mode: embedded-pipeline-spec
+      renderer: agentrun-control-plane
+      configRef: config/agentrun.yaml#controlPlane.lanes.nc01-release
+      pipelineRunPath: .tekton/agentrun-nc01-release.yaml
+      maxKeepRuns: 8
+      taskRunTemplate:
+        hostNetwork: true
+        dnsPolicy: ClusterFirstWithHostNet
+        fsGroup: 1000
   - extends: templates.consumers.sentinelV03
     variables:
       NODE: JD01
@@ -620,6 +645,30 @@ templates:
         pipeline_run_prefix: "agentrun-${nodeLower}-v02-ci"
         service_account: "agentrun-${nodeLower}-v02-tekton-runner"
         workspace_pvc_size: 2Gi
+    agentrunRelease:
+      id: "agentrun-${nodeLower}-release"
+      name: "agentrun-${nodeLower}-release"
+      namespace: agentrun-ci
+      providerType: gitea
+      url: https://gitea.pikapython.com/mirrors/pikasTech-agentrun
+      cloneUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
+      owner: mirrors
+      repo: pikasTech-agentrun
+      secretName: "pac-gitea-agentrun-${nodeLower}-release"
+      tokenKey: token
+      webhookSecretKey: webhook.secret
+      concurrencyLimit: 1
+      params:
+        git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
+        git_write_url: http://git-mirror-write.devops-infra.svc.cluster.local:8080/pikasTech/agentrun.git
+        source_branch: release
+        node: "${NODE}"
+        gitops_branch: "${nodeLower}-release-gitops"
+        source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/agentrun-release
+        pipeline_name: "agentrun-${nodeLower}-release-ci-image-publish"
+        pipeline_run_prefix: "agentrun-${nodeLower}-release-ci"
+        service_account: "agentrun-${nodeLower}-release-tekton-runner"
+        workspace_pvc_size: 2Gi
     sentinelV03:
       id: "sentinel-${nodeLower}-v03"
       name: "sentinel-${nodeLower}-v03"
@@ -691,6 +740,17 @@ templates:
       argoNamespace: argocd
       argoApplication: "agentrun-${nodeLower}-v02"
       closeoutGitOpsMirrorFlush: true
+    agentrunRelease:
+      id: "agentrun-${nodeLower}-release"
+      repositoryRef: "agentrun-${nodeLower}-release"
+      node: "${NODE}"
+      lane: "${nodeLower}-release"
+      namespace: agentrun-ci
+      pipeline: "agentrun-${nodeLower}-release-ci-image-publish"
+      pipelineRunPrefix: "agentrun-${nodeLower}-release-ci"
+      argoNamespace: argocd
+      argoApplication: "agentrun-${nodeLower}-release"
+      closeoutGitOpsMirrorFlush: true
     sentinelV03:
       id: "sentinel-${nodeLower}-v03"
       repositoryRef: "sentinel-${nodeLower}-v03"

docs/MDTODO/agentrun-dev-production-lanes.md

@@ -25,15 +25,15 @@ config/agentrun.yaml 声明 nc01-release lane（runtime.namespace=agentrun-relea
 
 R2 agentrun.yaml 模板参数化，nc01-v02 行为不变，完成任务后将详细报告写入[任务报告](./details/agentrun-dev-production-lanes/R2_Task_Report.md)。
 
-## R3
+## R3 [completed]
 
 R3 PaC/Gitea/GitOps 生产链 agentrun-nc01-release，完成任务后将详细报告写入[任务报告](./details/agentrun-dev-production-lanes/R3_Task_Report.md)。
 
-## R4
+## R4 [completed]
 
 R4 DB/Secret/provider 独立物化到 agentrun-release，完成任务后将详细报告写入[任务报告](./details/agentrun-dev-production-lanes/R4_Task_Report.md)。
 
-## R5
+## R5 [completed]
 
 R5 release 命名空间上线 manager 与内网 canary，完成任务后将详细报告写入[任务报告](./details/agentrun-dev-production-lanes/R5_Task_Report.md)。
 

docs/MDTODO/details/agentrun-dev-production-lanes/R3_Task_Report.md

@@ -0,0 +1,12 @@
+# R3 任务报告
+
+## 完成
+
+- `config/platform-infra/pipelines-as-code.yaml`：`agentrunRelease` repository/consumer 模板 + NC01 实例 `agentrun-nc01-release`
+- `config/platform-infra/gitea.yaml`：mirror key `agentrun-nc01-release`（branch `release`，gitops `nc01-release-gitops`）
+- control-plane 对象已 apply：Tekton SA/Role/Pipeline、Argo AppProject（Application 因 gitops 分支未解析保持 ComparisonError，已去掉 automated sync 防误伤 bootstrap）
+
+## 未完成
+
+- agentrun 仓创建 `release` / `nc01-release-gitops` 与 `.tekton/agentrun-nc01-release.yaml`
+- PaC Repository CR / webhook 在集群侧 bootstrap（consumer 权威已可解析）

docs/MDTODO/details/agentrun-dev-production-lanes/R4_Task_Report.md

@@ -0,0 +1,8 @@
+# R4 任务报告
+
+## 完成
+
+- host PostgreSQL 创建 role/database `agentrun_release`
+- owner secret：`agentrun/nc01-release-mgr-db.env`（不入库）
+- `secret-sync --lane nc01-release --confirm`：16 个 secret 就绪（2 个 omitted 非阻塞）
+- 独立 target namespace：`agentrun-release`

docs/MDTODO/details/agentrun-dev-production-lanes/R5_Task_Report.md

@@ -0,0 +1,14 @@
+# R5 任务报告
+
+## 完成
+
+- 渲染 `runtime-release` mgr/runner-rbac 并 server-side apply
+- 镜像复用现网 env digest `sha256:e080ba9a…`（与 v02 同构建物，namespace/DB 隔离）
+- Deployment `agentrun-mgr` Ready 1/1
+- `/health/live` 与 `/health/readiness`：`live=true ready=true`，DB migration `013_v02_runner_dispatch_outcome` ready
+- 内网 Service：`agentrun-mgr.agentrun-release.svc.cluster.local:8080`
+- v02 manager 仍 Ready 1/1
+
+## 说明
+
+bootstrap 字段 manager：`unidesk-agentrun-release-bootstrap`；后续以 GitOps 为准时需在 agentrun 仓写入 runtime-release 并由 PaC 推进。

docs/reference/agentrun.md

@@ -55,9 +55,14 @@ AgentRun 固定在 NC01 k3s，按 **namespace 隔离** 拆分 development / prod
 
 ```text
 NC01:k3s namespace agentrun-v02        # development runtime
-NC01:k3s namespace agentrun-release   # production runtime（R1 已建 ns；manager/DB/PaC 见 #2154 后续阶段）
+NC01:k3s namespace agentrun-release   # production runtime（manager 已上线；内网 ClusterIP）
 ```
 
+- production 内网入口：`http://agentrun-mgr.agentrun-release.svc.cluster.local:8080`
+- production DB：host PostgreSQL 独立库 `agentrun_release`（与 `agentrun_v02` 隔离）
+- production PaC consumer：`agentrun-nc01-release`（YAML 已声明；`nc01-release-gitops` 分支与自动链待 agentrun 仓补齐）
+- 当前 production manager 可由 YAML 渲染 manifest 做 bootstrap 上线；完整 PR merge → GitOps 自动链仍属 #2154 后续收敛
+
 所有 k3s 操作必须使用 UniDesk route 语法：
 
 ```bash