feat: add cicd branch follower

scripts/cli.ts

@@ -1,4 +1,5 @@
 // SPEC: PJ2026-01060509 出站诊断 draft-2026-06-26-p8-egress-job-friction.
+// SPEC: PJ2026-01060703 CI/CD branch follower draft-2026-07-03-p0-branch-follower.
 // UniDesk CLI dispatcher with bounded server lifecycle and job drill-down output.
 import { readConfig } from "./src/config";
 import { debugDispatch, debugEgressProxy, debugHealth, debugSshPool, debugTask, isDebugDispatchCommand, type DebugDispatchCommand } from "./src/debug";
@@ -267,6 +268,20 @@ async function main(): Promise<void> {
     return;
   }
 
+  if (top === "cicd") {
+    const { runCicdCommand } = await import("./src/cicd");
+    const result = await runCicdCommand(null, args.slice(1));
+    const ok = (result as { ok?: unknown }).ok !== false;
+    if (isRenderedCliResult(result)) {
+      emitText(result.renderedText, result.command || commandName);
+      if (!ok) process.exitCode = 1;
+      return;
+    }
+    emitJson(commandName, result, ok);
+    if (!ok) process.exitCode = 1;
+    return;
+  }
+
   if (top === "agentrun") {
     const { runAgentRunCommand } = await import("./src/agentrun");
     const agentRunArgs = args.slice(1);

scripts/src/help.ts

@@ -1,4 +1,5 @@
 // SPEC: PJ2026-01060509 出站诊断 draft-2026-06-26-p8-egress-job-friction.
+// SPEC: PJ2026-01060703 CI/CD branch follower draft-2026-07-03-p0-branch-follower.
 // Static CLI help for job aliases and server lifecycle progressive disclosure.
 import { ghHelp, ghScopedHelp } from "./gh";
 import { authBrokerHelp } from "./auth-broker";
@@ -57,6 +58,7 @@ export function rootHelp(): unknown {
       { command: "decision requirement list|create|show|update|upsert [id|docNo] [--title text] [--body-file path] [--type external_goal|internal_goal|goal|decision|blocker|debt|experiment] [--doc-no DC-...] [--doc-type ...] [--doc-priority P0|P1|P2|P3] [--signer text] [--issued-at ISO]", description: "Manage productized requirement records over the PostgreSQL records model, excluding meeting records." },
       { command: "decision show <id|docNo>", description: "Show one Decision Center record." },
       { command: "deploy check|plan|apply [--file deploy.json|--env dev|prod] [--service id] [--commit full-sha] [--dry-run] [--force]", description: "Reconcile services from origin/master:deploy.json environments; --commit overrides one reviewed artifact consumer such as frontend for release/v1 validation or rollback. code-queue artifact consumption is dev-only." },
+      { command: "cicd branch-follower plan|apply|status|run-once|events|logs", description: "Deploy and inspect the YAML-first Kubernetes branch follower for HWLAB v0.3, AgentRun v0.2, and web-probe sentinel master without using host worktrees as source authority." },
       { command: "dev-env validate|prewarm-images", description: "Validate D601 unidesk-dev guardrails or prewarm dev foundation images into native k3s containerd through a bounded async job." },
       { command: "artifact-registry plan|render|status|health|install|deploy-backend-core|deploy-service", description: "Manage the D601 host-managed CNCF Distribution registry and run pull-only artifact CD for supported services, including D601 direct, k3s-managed, and code-queue dev-only consumers." },
       { command: "auth-broker contract|health --dry-run|credential-request --dry-run|pr-preflight --dry-run", description: "Inspect the P0 Rust auth broker and CLI adapter contract without reading token values, writing GitHub, or starting services." },
@@ -730,6 +732,20 @@ function webProbeHelpSummary(): unknown {
   };
 }
 
+function cicdHelpSummary(): unknown {
+  return {
+    command: "cicd branch-follower plan|apply|status|run-once|events|logs",
+    output: "text by default; use --json, --raw, or -o json|yaml for machine output",
+    usage: [
+      "bun scripts/cli.ts cicd branch-follower plan",
+      "bun scripts/cli.ts cicd branch-follower apply --confirm --wait",
+      "bun scripts/cli.ts cicd branch-follower status",
+      "bun scripts/cli.ts cicd branch-follower run-once --all --dry-run",
+    ],
+    description: "YAML-first Kubernetes branch follower for three CI/CD running planes, with K8s state and adapter drill-down visibility.",
+  };
+}
+
 function hwlabG14HelpSummary(): unknown {
   return {
     command: "hwlab g14 monitor-prs|control-plane|git-mirror|tools-image|retirement",
@@ -795,6 +811,7 @@ export async function staticNamespaceHelp(args: string[]): Promise<unknown | nul
   if (top === "artifact-registry") return artifactRegistryHelp();
   if (top === "auth-broker") return authBrokerHelp();
   if (top === "gh") return ghScopedHelp(args.slice(1)) ?? ghHelp();
+  if (top === "cicd") return loadHelp(async () => (await import("./cicd")).cicdHelp(), cicdHelpSummary());
   if (top === "agentrun") return loadHelp(async () => (await import("./agentrun")).agentRunHelp(), agentRunHelpSummary());
   if (top === "platform-infra") return loadHelp(async () => (await import("./platform-infra")).platformInfraHelp(), platformInfraHelpSummary());
   if (top === "platform-db") return platformDbHelp();