feat(HEL-238): 按确认样图重做手机端系统管理，并加入部署基线门禁

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: multica-agent <github@multica.ai>

tools/README.md

@@ -25,7 +25,14 @@ registry, and verification tools.
   (default `moxiaobai@192.168.200.11`), refuses tags that do not end with the commit
   short SHA, verifies the revision label after the build, and appends a record to
   `~/xiaobai-build/BUILD_LOG.tsv` on the host. Building from any server-side working
-  tree is forbidden; see `DOCKER_DEPLOY.md`.
+  tree is forbidden; see `DOCKER_DEPLOY.md`. Before building, it runs
+  `tools/check_deploy_baseline.sh` so the candidate commit must contain the currently
+  running container's Git revision as an ancestor.
+- `bash tools/check_deploy_baseline.sh <commit> [--live-revision <sha>]`: deployment
+  ancestor gate. Reads the live `org.opencontainers.image.revision` from the running
+  `xiaobai-review` container (or `--live-revision` in tests), prints the live SHA,
+  candidate SHA, file diff, and commits the candidate would drop, then exits if the
+  live revision is not an ancestor of the candidate.
 
 `verify_baseline.py` does not inspect a parent checkout or skip tests according to files outside
 this application. Historical comparison scripts were retired after final standalone acceptance;