ci: 修复三阶段效率改造合并后审计问题

[a3384379]

变更

• 按实际 Alembic 目录、构建输入和镜像清单修正 CI 分层；Bake 配置纳入治理边界。Security 额外构建、核验并扫描 Postgres WALG 镜像；扫描发现旧镜像的可修复漏洞后，固定 Postgres 17.11 与 WAL-G v3.0.9 源码，使用已修补的 Go 工具链和依赖重建。
• 为 Compact 路径加入当前 PR 上运行的基础兼容验收，并接入影子汇总；完整 RC 保持原手动入口。
• 治理 PR 避免普通链路与 Bootstrap 重复执行完整作业；有效标签与新 Head 收敛到同一 PR 活动组。
• 已知源码映射与直接改动的测试取并集，删除或重命名测试、未知源码和共享测试输入仍回退全侧。
• 串行处理 Required Gate 唤醒，依据当前 run/attempt 和真实状态发布，补事件交错回归；同步修订阶段二、三历史记录。

本地验证

• 定向后端测试：93 passed。
• Ruff format/check、mypy（438 source files）、lint-imports、git diff --check 通过。
• 12 个工作流 YAML 均可解析；Compact Compose 配置校验通过。
• 本机真实 Dockerfile 镜像构建成功；Grype v0.116.1 扫描 High/Critical 0，Low 1；wal-g backup-push --help 与 Postgres 版本检查通过。

远程验收边界

本 PR 修改 CI 治理文件，普通 Required Gate 预期保持阻断，需维护者核对当前 Head 的 Bootstrap 作业并按既有受控流程处理 Ruleset。Compact 新 job 仍需实际 PR 运行样本；本 PR 不宣称完成完整 RC、基础镜像发布或跨工作流同产物复用。

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-27T09:31:11.579458Z	c04ab49	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c04ab49bc6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".