部署(HEL-235B): 服务器本地目录纳入 Git 管理，固化 main 校验构建流程

Co-authored-by: multica-agent <github@multica.ai>

tools/README.md

@@ -20,12 +20,18 @@ registry, and verification tools.
 - `python tools/backfill_recent_snapshots.py --account <admin> [--lookback 60] [--dry-run]`:
   auditable recent trading-day dashboard snapshot backfill. See
   `docs/maintenance/行情历史补档.md`.
-- `bash tools/build_image.sh <commit> <tag>`: the only sanctioned way to build the
-  production Docker image. Streams `git archive <commit>` to the deploy host over SSH
-  (default `moxiaobai@192.168.200.11`), refuses tags that do not end with the commit
+- `tools/update_from_main.sh` (deployed to the server as
+  `~/xiaobai-build/update-from-main.sh`): the server-side update-and-build entry for
+  the managed local worktree at `/opt/1panel/docker/compose/xiaobaifupan`. Fetches
+  Gitea `main`, enforces branch/clean/fast-forward checks, builds a
+  `main-<shortsha>` tagged image with the revision label, and verifies the label
+  after the build. `tools/xiaobai-git` is the matching git wrapper for that
+  worktree (`status`/`log`/`diff`).
+- `bash tools/build_image.sh <commit> <tag>`: agent-grade entry that streams
+  `git archive <commit>` to the deploy host over SSH (default
+  `moxiaobai@192.168.200.11`), refuses tags that do not end with the commit
   short SHA, verifies the revision label after the build, and appends a record to
-  `~/xiaobai-build/BUILD_LOG.tsv` on the host. Building from any server-side working
-  tree is forbidden; see `DOCKER_DEPLOY.md`. Before building, it runs
+  `~/xiaobai-build/BUILD_LOG.tsv` on the host. Before building, it runs
   `tools/check_deploy_baseline.sh` so the candidate commit must contain the currently
   running container's Git revision as an ancestor.
 - `bash tools/check_deploy_baseline.sh <commit> [--live-revision <sha>]`: deployment