fix(cd): gate deploy on synced revision

.gitea/workflows/cd.yaml

@@ -964,7 +964,7 @@ jobs:
             local http_code
             local status
             set +e
-            http_code=$(curl -sS -w "%{http_code}" -o /dev/null --connect-timeout 3 --max-time 5 "${{ env.API_HEALTH_URL }}" 2>/dev/null)
+            http_code=$(curl -sS -w "%{http_code}" -o /dev/null --connect-timeout 3 --max-time 8 "${{ env.API_HEALTH_URL }}" 2>/dev/null)
             status=$?
             set -e
             if [ "$status" -ne 0 ]; then
@@ -978,9 +978,10 @@ jobs:
             fi
           }
 
-          # 等待 ArgoCD Application Synced（最多 180s）。只看
-          # Synced/Healthy 可能誤判成上一個 revision 已同步，因此有
-          # deploy commit 時必須同時確認 status.sync.revision。
+          # 等待 ArgoCD Application 同步到目標 revision（最多 180s）。
+          # 2026-05-24 Codex: top-level Application health can stay Degraded
+          # without per-resource health detail. Treat that as rollout evidence,
+          # then let kubectl rollout status and API health decide pass/fail.
           echo "⏳ 等待 ArgoCD sync..."
           $KUBECTL annotate application awoooi-prod -n argocd \
             argocd.argoproj.io/refresh=hard --overwrite >/dev/null 2>&1 || true
@@ -998,9 +999,12 @@ jobs:
                 record_rollout_risk "argocd_status_unknown sync=$SYNC health=$HEALTH revision=$SHORT_REVISION expected=${SHORT_EXPECTED:-any}"
               fi
             fi
-            if [ "$SYNC" = "Synced" ] && [ "$HEALTH" = "Healthy" ]; then
+            if [ "$SYNC" = "Synced" ]; then
               if [ -z "$EXPECTED_REVISION" ] || [ "$REVISION" = "$EXPECTED_REVISION" ]; then
-                echo "✅ ArgoCD Synced + Healthy"
+                if [ "$HEALTH" != "Healthy" ]; then
+                  record_rollout_risk "argocd_health_not_healthy health=$HEALTH revision=$SHORT_REVISION"
+                fi
+                echo "✅ ArgoCD Synced to target revision (health=$HEALTH)"
                 break
               fi
             fi
@@ -1020,7 +1024,7 @@ jobs:
           # Health Check
           HEALTH_PASS=0
           for i in 1 2 3; do
-            HTTP_CODE=$(curl -s -w "%{http_code}" -o /dev/null --connect-timeout 10 "${{ env.API_HEALTH_URL }}")
+            HTTP_CODE=$(curl -s -w "%{http_code}" -o /dev/null --connect-timeout 10 --max-time 12 "${{ env.API_HEALTH_URL }}")
             if [ "$HTTP_CODE" = "200" ]; then
               echo "✅ API 健康檢查通過"
               HEALTH_PASS=1