fix: 修复任务生命周期与调度就绪，优化执行和构建开销 (#3069)

* fix: harden task lifecycle and scheduler readiness

* fix: confine log writes to the configured log directory

* fix: verify complete build artifacts and untracked inputs

* fix: reconcile scheduler state and make stop win startup races

* fix: isolate cron generations and serialize scheduler recovery

docker/Dockerfile.debian

@@ -12,7 +12,7 @@ RUN set -x && \
   apt-get install --no-install-recommends -y libatomic1 && \
   npm i -g pnpm@8.3.1 && \
   cd /tmp/build && \
-  pnpm install --prod
+  pnpm install --prod --frozen-lockfile
 
 FROM python:3.11.14-slim-bookworm
 
@@ -82,15 +82,19 @@ RUN mkdir -p ${QL_DIR} && \
 
 USER qinglong
 ARG SOURCE_COMMIT
-RUN git clone --depth=1 -b ${QL_BRANCH} ${QL_URL} ${QL_DIR} && \
-  cd ${QL_DIR} && \
-  cp -f .env.example .env && \
-  chmod 777 ${QL_DIR}/shell/*.sh && \
-  chmod 777 ${QL_DIR}/docker/*.sh && \
-  git clone --depth=1 -b ${QL_BRANCH} https://github.com/${QL_MAINTAINER}/qinglong-static.git /tmp/static && \
-  mkdir -p ${QL_DIR}/static && \
-  cp -rf /tmp/static/* ${QL_DIR}/static && \
-  rm -rf /tmp/static
+LABEL org.opencontainers.image.revision=${SOURCE_COMMIT}
+RUN git clone --depth=1 -b ${QL_BRANCH} ${QL_URL} ${QL_DIR} \
+  && cd ${QL_DIR} \
+  && if [ -n "${SOURCE_COMMIT}" ]; then git fetch --depth=1 origin "${SOURCE_COMMIT}" && git reset --hard FETCH_HEAD; fi \
+  && cp -f .env.example .env \
+  && chmod 777 ${QL_DIR}/shell/*.sh \
+  && chmod 777 ${QL_DIR}/docker/*.sh
+
+# Downloaded by CI from the build-static job in this workflow run.
+COPY --chown=qinglong:qinglong static/ /ql/static/
+COPY docker/verify-build.cjs docker/build-manifest.cjs /tmp/
+COPY --from=builder /tmp/build/pnpm-lock.yaml /tmp/dependency-lock.yaml
+RUN cd ${QL_DIR} && node /tmp/verify-build.cjs /tmp/dependency-lock.yaml
 
 ENV PNPM_HOME=${QL_DIR}/data/dep_cache/node \
   PYTHON_HOME=${QL_DIR}/data/dep_cache/python3 \