fix(cicd): allow mirror fetch by exact commit

docs/reference/spec-v02-cicd.md

@@ -130,6 +130,8 @@ devops-infra git mirror 仍是 PipelineRun 和 Argo CD 的集群内读写源。`
 
 `devops-infra` git mirror/relay 同样不设周期 CronJob。标准触发命令 `bun scripts/cli.ts hwlab g14 control-plane trigger-current --lane v02 --confirm` 会在创建 PipelineRun 前按需同步 mirror；`bun scripts/cli.ts hwlab g14 git-mirror sync --confirm` 只作为显式 mirror 维护或诊断入口。promotion 成功后可执行 `bun scripts/cli.ts hwlab g14 git-mirror flush --confirm` 把本地 `v0.2-gitops` 推送到 GitHub。`git-mirror apply` 维护 mirror 的 PVC、读服务、写服务、同步/flush 脚本和旧 CronJob 清理；`git-mirror sync` 创建一次性 Job，只同步 allowlist refs `v0.2`、`v0.2-gitops`、`G14` 和 `G14-gitops`，先 fetch 到隐藏 staging refs，校验 commit/tree/object closure，再用 `update-ref` 发布到公开 refs。这样 mirror read path 与 GitOps write path 都落在本地磁盘和集群网络，同时避免 CI 看到 ref 已更新但对象还不可 checkout 的半发布窗口。
 
+mirror 的 HTTP upload-pack 必须允许按精确 commit SHA 拉取已存在对象：`uploadpack.allowReachableSHA1InWant=true` 且 `uploadpack.allowAnySHA1InWant=true`。v0.2 Code Agent 通过 AgentRun 传递 `resourceBundleRef.commitId` 来复现实验时的源码身份，runner 会执行等价的 `git fetch --depth=1 origin <commitId>`；如果 mirror 只允许 advertised refs，旧 runtime commit、GitOps 已推进后的 commit 或隐藏 staging 已验证对象会返回 `Server does not allow request for unadvertised object` 并表现为 `git fetch failed with code 128`。这不是把 AgentRun 降级成浮动 branch fetch 的理由，修复点是 mirror read service 的 upload-pack 策略。
+
 `hwlab-cli` 不属于 v0.2 CI/CD service matrix。它是 `G14:/root/hwlab-v02` 和 v0.2 worktree 内的短连接源码 client，只用 Bun 直接调用 Cloud Web 同源 API；不得加入 PipelineRun `services` 参数、artifact catalog、BuildKit publish、runtime desired state、Deployment、Service、Job 或 image build。CLI-only source 变更推送到 `origin/v0.2` 后，`trigger-current --lane v02` 应表现为 `build=0 reuse=<runtime-services>` 的 source-only fast path，用于证明 source/mirror/GitOps 没有产生旧 runtime artifact 副作用。若出现 `build-hwlab-cli` TaskRun、`hwlab-cli` artifact service、CLI 镜像或 CLI 常驻服务，均视为旧门禁/旧断言残留，直接删除并回到 `docs/reference/spec-v02-hwlab-cli.md` 的短连接 client 口径。
 
 `rpt004:mvp:e2e`、`runner:issue-visibility:preflight` 和 `dev-base-image:preflight` 不属于 v0.2 最小 CI/CD 校验入口；它们代表旧验收、旧 runner 可见性预检或旧镜像基础预检口径。v0.2 `check/validate` 不再引用这些任务，若它们重新进入默认 check plan、package script 或 PipelineRun，应直接删除该入口，而不是为其补兼容逻辑。

scripts/g14-gitops-render.mjs

@@ -3193,7 +3193,7 @@ fi
 /script/install-hooks.sh
 git -C "$repo_path" config uploadpack.hideRefs refs/mirror-stage
 git -C "$repo_path" config uploadpack.allowReachableSHA1InWant true
-git -C "$repo_path" config uploadpack.allowAnySHA1InWant false
+git -C "$repo_path" config uploadpack.allowAnySHA1InWant true
 git -C "$repo_path" config --unset-all remote.origin.fetch 2>/dev/null || true
 git -C "$repo_path" config --add remote.origin.fetch '+refs/heads/v0.2:refs/mirror-stage/heads/v0.2'
 git -C "$repo_path" config --add remote.origin.fetch '+refs/heads/v0.2-gitops:refs/mirror-stage/heads/v0.2-gitops'

scripts/g14-gitops-render.test.ts

@@ -134,6 +134,8 @@ test("v02 render follows TypeScript runtime checks and does not self-patch boots
     const gitMirrorConfigMap = gitMirrorJson.items.find((item) => item.kind === "ConfigMap" && item.metadata?.name === "git-mirror-sync-script");
     const gitMirrorScripts = gitMirrorConfigMap?.data ?? {};
     const gitMirrorScript = gitMirrorScripts["sync.sh"] ?? "";
+    assert.match(gitMirrorScript, /uploadpack\.allowReachableSHA1InWant true/u);
+    assert.match(gitMirrorScript, /uploadpack\.allowAnySHA1InWant true/u);
     assert.match(gitMirrorScript, /refs\/heads\/v0\.2:refs\/mirror-stage\/heads\/v0\.2/u);
     assert.match(gitMirrorScript, /refs\/heads\/v0\.2-gitops:refs\/mirror-stage\/heads\/v0\.2-gitops/u);
     assert.match(gitMirrorScript, /refs\/heads\/G14:refs\/mirror-stage\/heads\/G14/u);