fix: harden admin production source gates

.adm-api.pid

@@ -1 +0,0 @@
-26747

.adm-preview.pid

@@ -1 +0,0 @@
-25645

.gitignore

@@ -8,4 +8,5 @@ dist-ssr/
 memind-lib/
 .vite/
 *.log
+*.pid
 logs/

scripts/release-prod.sh

@@ -88,12 +88,24 @@ need_cmd shasum
 need_cmd node
 
 if [[ -x "${ROOT}/scripts/check-release-ready.sh" ]]; then
-  bash "${ROOT}/scripts/check-release-ready.sh"
+  ALLOW_MAIN_RELEASE=1 bash "${ROOT}/scripts/check-release-ready.sh"
 else
   echo "缺少发布前闸门: ${ROOT}/scripts/check-release-ready.sh" >&2
   exit 1
 fi
 
+ROOT_GIT_BRANCH="$(git -C "${ROOT}" branch --show-current)"
+ROOT_GIT_HEAD="$(git -C "${ROOT}" rev-parse HEAD)"
+ROOT_ORIGIN_HEAD="$(git -C "${ROOT}" rev-parse origin/main)"
+[[ "${ROOT_GIT_BRANCH}" == "main" ]] || {
+  echo "memindadm 生产发布必须从 main 执行，当前分支: ${ROOT_GIT_BRANCH:-detached}" >&2
+  exit 1
+}
+[[ "${ROOT_GIT_HEAD}" == "${ROOT_ORIGIN_HEAD}" ]] || {
+  echo "memindadm main 必须与 origin/main 完全一致" >&2
+  exit 1
+}
+
 [[ -f "${IGNORE_FILE}" ]] || {
   echo "缺少忽略文件: ${IGNORE_FILE}" >&2
   exit 1
@@ -127,8 +139,23 @@ say "验证共享模块图像运行依赖"
   exit 1
 }
 
-MEMIND_GIT_HEAD="$(git -C "${MEMIND_SRC}" rev-parse HEAD 2>/dev/null || echo unknown)"
+git -C "${MEMIND_SRC}" fetch origin main --quiet
-MEMIND_GIT_BRANCH="$(git -C "${MEMIND_SRC}" branch --show-current 2>/dev/null || echo detached)"
+MEMIND_GIT_HEAD="$(git -C "${MEMIND_SRC}" rev-parse HEAD)"
+MEMIND_ORIGIN_HEAD="$(git -C "${MEMIND_SRC}" rev-parse origin/main)"
+MEMIND_GIT_BRANCH="$(git -C "${MEMIND_SRC}" branch --show-current)"
+[[ "${MEMIND_GIT_BRANCH}" == "main" ]] || {
+  echo "Memind 共享模块必须从 main 打包，当前分支: ${MEMIND_GIT_BRANCH:-detached}" >&2
+  exit 1
+}
+[[ "${MEMIND_GIT_HEAD}" == "${MEMIND_ORIGIN_HEAD}" ]] || {
+  echo "Memind main 必须与 origin/main 完全一致" >&2
+  exit 1
+}
+[[ -z "$(git -C "${MEMIND_SRC}" status --porcelain=v1 --untracked-files=all)" ]] || {
+  echo "Memind 共享模块工作区必须干净" >&2
+  git -C "${MEMIND_SRC}" status --short --untracked-files=all >&2
+  exit 1
+}
 
 say "打包 Memind 共享模块到 memind-lib"
 rm -rf "${MEMIND_LIB}"