部署(HEL-235B): 补严分叉与镜像标签校验

Co-authored-by: multica-agent <github@multica.ai>

tools/update_from_main.sh

@@ -33,6 +33,8 @@ $DIRTY"
 LOCAL_HEAD="$(g rev-parse HEAD)"
 REMOTE_HEAD="$(g rev-parse origin/main)"
 if [ "$LOCAL_HEAD" != "$REMOTE_HEAD" ]; then
+  g merge-base --is-ancestor "$LOCAL_HEAD" "$REMOTE_HEAD" \
+    || refuse "本地 main 与 origin/main 历史分叉，停止（未改写工作目录）"
   TOP_AD="$(g diff --name-status HEAD origin/main | grep -E "^[AD][[:space:]]+[^/]+$" || true)"
   [ -z "$TOP_AD" ] || refuse "main 相比本地新增/删除了顶层文件，目录顶层归 root，需管理员执行：
 $TOP_AD"
@@ -54,6 +56,8 @@ echo "==> 校验通过：本地 HEAD = origin/main = ${LOCAL_HEAD}（${SHORT}）
 
 if [ "$MODE" = "verify-tag" ]; then
   TAG="${2:?用法: update-from-main.sh verify-tag <tag>}"
+  [ "$TAG" = "main-${SHORT}" ] \
+    || refuse "镜像标签必须是当前 main 对应的 main-${SHORT}，收到：${TAG}"
   LABEL="$(docker image inspect "${IMAGE_REPO}:${TAG}" \
     --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' 2>/dev/null)" \
     || refuse "镜像 ${IMAGE_REPO}:${TAG} 不存在"