fix(ci): extend production deploy readback window

.gitea/workflows/cd.yaml

@@ -1720,7 +1720,7 @@ jobs:
           expected = os.environ["IMAGE_TAG"].strip().lower()
           expected_short = expected[:10]
           url = "https://awoooi.wooo.work/api/v1/agents/delivery-closure-workbench"
-          attempts = int(os.environ.get("DEPLOY_READBACK_ATTEMPTS", "18"))
+          attempts = int(os.environ.get("DEPLOY_READBACK_ATTEMPTS", "36"))
           sleep_seconds = int(os.environ.get("DEPLOY_READBACK_SLEEP_SECONDS", "10"))
           last_error = ""
           for attempt in range(1, attempts + 1):

docs/LOGBOOK.md

@@ -1,3 +1,12 @@
+## 2026-06-30 — 10:18 production deploy readback window 擴充
+
+**照主線修正的問題**：
+- Gitea CD `#4019` 對 `3580b7600 feat(iwooos): enable wazuh readonly metadata flag` 在 production readback window 內判 Failure，但 K8s rollout 隨後完成，production API 已讀回 `latest_successful_deployed_source_short_sha=3580b7600f`。
+- `.gitea/workflows/cd.yaml` 將 production deploy readback 預設等待窗從 `18 * 10s` 擴成 `36 * 10s`，避免 API / Argo rollout 延遲收斂時產生假紅。
+- `ops/runner/test_cd_controlled_runtime_profile.py` 同步鎖住新 readback contract；runner pressure guard 與 fail-closed 判斷不變。
+
+**邊界**：未放寬 110 host pressure gate，未改 runner label，未 restart Docker daemon / Nginx / K3s / DB / firewall，未 prune / restore / DB write，未讀 secret / token / raw sessions / SQLite / `.env`，未使用 GitHub / `gh` / GitHub API。
+
 ## 2026-06-30 — 09:50 P0-006 StockPlatform live public API drift readback
 
 **照主線修正的問題**：

ops/runner/test_cd_controlled_runtime_profile.py

@@ -55,7 +55,7 @@ def test_cd_requires_production_deploy_readback_after_rollout() -> None:
     assert "apps/api/tests/test_awoooi_production_deploy_readback_blocker.py)" in text
     assert "tests/test_awoooi_production_deploy_readback_blocker.py" in text
     assert "production_deploy_readback_mismatch=" in text
-    assert 'attempts = int(os.environ.get("DEPLOY_READBACK_ATTEMPTS", "18"))' in text
+    assert 'attempts = int(os.environ.get("DEPLOY_READBACK_ATTEMPTS", "36"))' in text
     assert 'sleep_seconds = int(os.environ.get("DEPLOY_READBACK_SLEEP_SECONDS", "10"))' in text
     assert "production_deploy_readback_attempt=" in text
     assert "time.sleep(sleep_seconds)" in text