fix: make release deployment safely repeatable

deploy/install.sh

@@ -34,12 +34,18 @@ if [[ "$(git branch --show-current)" != "main" ]] || ! git diff --quiet || ! git
   exit 1
 fi
 release_commit="$(git rev-parse HEAD)"
-release_created_at="$(git show -s --format=%cI "${release_commit}")"
 remote_main="$(git ls-remote origin refs/heads/main | cut -f1)"
 if [[ -z "${remote_main}" || "${remote_main}" != "${release_commit}" ]]; then
   echo "当前 main 提交尚未同步到 Gitea origin/main，拒绝创建发布标签。" >&2
   exit 1
 fi
+release_tag_commit="$(git ls-remote origin "refs/tags/${release_tag}" "refs/tags/${release_tag}^{}" | tail -n1 | cut -f1)"
+release_created_at_commit="${release_tag_commit:-${release_commit}}"
+if ! git cat-file -e "${release_created_at_commit}^{commit}" 2>/dev/null; then
+  echo "现有发布标签指向本地不可验证的提交，拒绝重新生成同版本发布物。" >&2
+  exit 1
+fi
+release_created_at="$(git show -s --format=%cI "${release_created_at_commit}")"
 
 if [[ ! -f "${project_root}/.runtime/dingtalk-mcp.env" ]]; then
   echo "缺少 .runtime/dingtalk-mcp.env；首次部署前需先配置网关企业凭证。" >&2
@@ -74,18 +80,25 @@ npm run test-bundle:build -- \
 (cd "${release_dir}" && sha256sum -c SHA256SUMS)
 npm run release:verify -- --release-dir release
 
-echo "[3/8] 发布或复用 Gitea 国内备用下载源"
+echo "[3/8] 发布或复用 Gitea 国内首选下载源"
 gitea_releases_json="$(mktemp)"
 trap 'rm -f "${gitea_releases_json}"' EXIT
 tea releases list --remote origin --limit 100 --output json >"${gitea_releases_json}"
-if ! node -e 'const fs=require("fs");const tag=process.argv[1];const rows=JSON.parse(fs.readFileSync(0,"utf8"));process.exit(rows.some((row)=>row.tag_name===tag||row.tag===tag||row.Tag===tag)?0:1)' \
-  "${release_tag}" <"${gitea_releases_json}"; then
+if node scripts/release-tag-exists.mjs "${release_tag}" <"${gitea_releases_json}"; then
+  :
+else
+  release_lookup_status=$?
+  if [[ "${release_lookup_status}" -ne 1 ]]; then
+    echo "无法可靠判断 Gitea Release 是否存在，拒绝继续部署。" >&2
+    exit "${release_lookup_status}"
+  fi
   release_flags=()
   [[ "${release_version}" == *-* ]] && release_flags+=(--prerelease)
   tea releases create --remote origin --tag "${release_tag}" --target "${release_commit}" \
     --title "${release_tag}" --note "Signed DingTalk approval client ${release_version}" "${release_flags[@]}"
 fi
-mapfile -t mirror_assets < <(find "${release_dir}" -mindepth 1 -maxdepth 1 -type f -print | sort)
+mapfile -t mirror_assets < <(find "${release_dir}" -mindepth 1 -maxdepth 1 -type f \
+  ! -name 'agent-test-install.md' ! -name 'dingmcp-test-bundle.tar.gz' -print | sort)
 missing_mirror_assets=()
 mirror_check_file="$(mktemp)"
 for asset in "${mirror_assets[@]}"; do
@@ -106,7 +119,7 @@ for asset in "${mirror_assets[@]}"; do
   asset_name="$(basename "${asset}")"
   curl --fail --silent --show-error --location "${gitea_release_base_url}/${asset_name}" -o "${mirror_check_file}"
   [[ "$(sha256sum "${mirror_check_file}" | cut -d' ' -f1)" == "$(sha256sum "${asset}" | cut -d' ' -f1)" ]] || {
-    echo "Gitea 备用发布物校验失败：${asset_name}" >&2
+    echo "Gitea 首选发布物校验失败：${asset_name}" >&2
     exit 1
   }
 done