fix(cd): 修復 non-fast-forward push 失敗 + 部署 8be87b0 修復版

1. kustomization.yaml: c439277 → 8be87b0 (auto_approve/decision_manager/webhooks)
2. cd.yaml: git push 前先 fetch+rebase，避免 CI 期間其他 commit 造成 non-fast-forward

8be87b0 包含:
- auto_approve: high risk 開放自動執行 + DESTRUCTIVE_PATTERNS 攔截
- decision_manager: classify_notification() 接通 + NO_ACTION 早退 + MCP context 收集
- webhooks: target_resource 修正 (name/container label 提取，DockerContainerUnhealthy 不再 target=alertname)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/cd.yaml

@@ -387,6 +387,9 @@ jobs:
             # 用 token 推送（避免 SSH key 需要額外設定 push 權限）
             git remote remove gitea 2>/dev/null || true
             git remote add gitea http://wooo:${GITEA_TOKEN}@192.168.0.110:3001/wooo/awoooi.git
+            # 先 rebase 避免 non-fast-forward (其他 commit 在 CI 期間已推入)
+            git fetch gitea main
+            git rebase gitea/main
             git push gitea main
             echo "✅ kustomization.yaml 已 push，等待 ArgoCD sync..."
           }

k8s/awoooi-prod/kustomization.yaml

@@ -38,7 +38,7 @@ resources:
 images:
 - name: 192.168.0.110:5000/library/api:IMAGE_TAG_PLACEHOLDER
   newName: 192.168.0.110:5000/awoooi/api
-  newTag: c439277fc3ddec4ce207e9ce3b82dbac87f7da6e
+  newTag: 8be87b0f32a7430d86e93b9be63677c0e498bb79
 - name: 192.168.0.110:5000/library/web:IMAGE_TAG_PLACEHOLDER
   newName: 192.168.0.110:5000/awoooi/web
-  newTag: c439277fc3ddec4ce207e9ce3b82dbac87f7da6e
+  newTag: 8be87b0f32a7430d86e93b9be63677c0e498bb79