fix: isolate G14 BuildKit sidecar sockets

docs/reference/g14-gitops-cicd.md

@@ -67,6 +67,7 @@ G14 CI/CD 加速的第一判定标准不是 PipelineRun 总耗时单点变短，
 - `ci-json` 仍是大头，当前量级约 90 秒。它包含 Git clone、checkout、`npm ci`、Playwright cache probe 和 `CI.json` 命令执行。继续加速应优先减少每轮 `npm ci` 成本，例如使用预热 workspace/cache、依赖层镜像或把源码校验拆成更细粒度的 Tekton Task。
 - `gitops-promote` 仍是大头，当前量级约 100 秒。它包含 source branch freshness check、artifact catalog refresh、render/check、clone `G14-gitops`、复制 generated desired state、commit 和 push。继续加速应优先减少 git clone/push 成本，例如使用浅 clone、持久 workspace、server-side patch 或把 GitOps repo 操作单独缓存。
 - per-service TaskRun 数量增加后会有 k8s 调度和 sidecar 生命周期开销。reuse-only 任务很快，但如果每个 unchanged service 都启动完整 buildkit sidecar，调度开销会抵消部分收益；长期目标是让 unchanged service 走更轻量的 reuse Task，changed service 才启动 BuildKit。
+- per-service BuildKit 必须使用 Pod 内 Unix socket 或其他 Pod-scoped 端点，禁止在 hostNetwork 下绑定固定 TCP 端口。多个 service TaskRun 并发时，如果 sidecar 统一监听 `0.0.0.0:1234`，会抢同一个宿主端口，导致主 step 结果成功但 Pod phase 显示 Failed，严重污染 CI 观测。
 - Argo sync/health 不是 instant。`Sync=Synced` 后 health 仍可能因为 replicas=0 的模板 Deployment、未排除 health 的模板 Job 或 StatefulSet 旧 revision 显示 `Suspended`/`Progressing`。这时应先看实际长驻 workload ready 与具体 unhealthy resource，不要只看 Application 总 health；如果 suspended Job 只是模板资源，应修 render 注解而不是把 DEV rollout 判成失败。
 - StatefulSet 旧 ordinal pod 可能长期卡在历史缺失镜像上，即使 StatefulSet 当前 template 已经修正。DEV 可按运行面热修流程删除旧 Pending pod 让 StatefulSet 按当前 template 重建；PROD namespace 需要明确 maintenance 授权后再做同类删除。
 

scripts/g14-gitops-render.mjs

@@ -713,7 +713,7 @@ export HWLAB_CI_ARTIFACT_RUN_OWNER="tekton"
 export HWLAB_DEV_REGISTRY_PREFIX="$(params.registry-prefix)"
 export HWLAB_DEV_REGISTRY_K8S_NATIVE=1
 export PATH="/workspace/buildkit-bin:$PATH"
-export HWLAB_BUILDKIT_ADDR="tcp://127.0.0.1:1234"
+export HWLAB_BUILDKIT_ADDR="unix:///workspace/buildkit-run/buildkitd.sock"
 if [ -n "$(params.base-image)" ]; then export HWLAB_DEV_BASE_IMAGE="$(params.base-image)"; fi
 if [ -n "\${HWLAB_DEV_BASE_IMAGE:-}" ]; then
   echo '{"event":"dependency-local-registry-probe-start","phase":"service-image-publish-pre-base-image","serviceId":"'"$(params.service-id)"'","target":"http://127.0.0.1:5000/v2/"}'
@@ -1187,6 +1187,10 @@ function buildkitBinVolume() {
   return { name: "buildkit-bin", emptyDir: {} };
 }
 
+function buildkitRunVolume() {
+  return { name: "buildkit-run", emptyDir: {} };
+}
+
 function prepareBuildkitClientStep() {
   return {
     name: "prepare-buildkit-client",
@@ -1206,8 +1210,9 @@ function buildkitSidecar() {
   return {
     name: "buildkitd",
     image: buildkitRunnerImage,
-    args: ["--addr", "tcp://0.0.0.0:1234", "--oci-worker-no-process-sandbox"],
+    args: ["--addr", "unix:///workspace/buildkit-run/buildkitd.sock", "--oci-worker-no-process-sandbox"],
     env: proxyEnv(),
+    volumeMounts: [{ name: "buildkit-run", mountPath: "/workspace/buildkit-run" }],
     securityContext: {
       runAsUser: 1000,
       runAsGroup: 1000,
@@ -1310,7 +1315,7 @@ function perServiceBuildTask(serviceId) {
       ],
       results: serviceResultFields.map((field) => ({ name: field, description: `${serviceId} ${field}` })),
       workspaces: [{ name: "source" }],
-      volumes: [serviceWorkVolume(), buildkitBinVolume()],
+      volumes: [serviceWorkVolume(), buildkitBinVolume(), buildkitRunVolume()],
       sidecars: [buildkitSidecar()],
       steps: [
         prepareBuildkitClientStep(),
@@ -1319,7 +1324,7 @@ function perServiceBuildTask(serviceId) {
           image: ciToolsRunnerImage,
           securityContext: { runAsUser: 1000, runAsGroup: 1000 },
           env: proxyEnv(),
-          volumeMounts: [{ name: "service-work", mountPath: "/workspace/service-work" }, { name: "buildkit-bin", mountPath: "/workspace/buildkit-bin" }],
+          volumeMounts: [{ name: "service-work", mountPath: "/workspace/service-work" }, { name: "buildkit-bin", mountPath: "/workspace/buildkit-bin" }, { name: "buildkit-run", mountPath: "/workspace/buildkit-run" }],
           script: perServicePublishScript()
         }
       ]