feat(workflow): add risk-based release gates

release-gate/release-script.test.mjs

@@ -27,7 +27,7 @@ function assertShellParses(source, label) {
   assert.equal(result.status, 0, `${label} failed bash -n:\n${result.stderr}`);
 }
 
-test('production release verifies gate report before any 103 connection', async () => {
+test('production release verifies gate report before 103 preflight and upload', async () => {
   const source = await fs.readFile(
     path.join(ROOT, 'scripts', 'release-portal-runtime-prod.sh'),
     'utf8',
@@ -49,10 +49,10 @@ test('production stable release verifies canary promotion evidence before gate c
   );
   const promotionIndex = source.indexOf('verify-canary-promotion-evidence.mjs');
   const gateIndex = source.indexOf('verify-release-gate-report.mjs');
-  const incrementalIndex = source.indexOf('run-release-gate-incremental.mjs');
+  const impactIndex = source.indexOf('run-release-gate-impact.mjs');
   assert.ok(promotionIndex > 0, 'missing canary promotion evidence verifier');
   assert.ok(gateIndex > promotionIndex, 'gate verification must follow promotion evidence');
-  assert.ok(incrementalIndex > 0, 'missing incremental gate fallback');
+  assert.ok(impactIndex > 0, 'missing risk-based impact gate fallback');
   assert.doesNotMatch(source, /在同一候选完成 103 灰度验收且晋升证据校验落地前，禁止非 dry-run/);
   assert.match(source, /read_agent_run_status_json/);
   assert.match(source, /sed -n '\/\^\{/);
@@ -140,6 +140,9 @@ test('production canary verifies the exact Gate artifact before any 103 prefligh
   assert.match(source, /branch.*!= "main"/);
   assert.match(source, /rev-parse origin\/main/);
   assert.match(source, /Production canary release forbids/);
+  assert.match(source, /run-release-gate-impact\.mjs/);
+  assert.match(source, /MEMIND_RELEASE_BASE_COMMIT/);
+  assert.match(source, /-z "\$\{DEPLOYED_SHA\}".*"\$\{DRY_RUN\}" -ne 1/);
 });
 
 test('production canary keeps stable 8081 live and switches only after verified backups and fallback', async () => {