fix: 修复任务生命周期与调度就绪，优化执行和构建开销 (#3069)

* fix: harden task lifecycle and scheduler readiness

* fix: confine log writes to the configured log directory

* fix: verify complete build artifacts and untracked inputs

* fix: reconcile scheduler state and make stop win startup races

* fix: isolate cron generations and serialize scheduler recovery

docker/verify-build.cjs

@@ -0,0 +1,49 @@
+const fs = require('node:fs');
+const crypto = require('node:crypto');
+const { execFileSync } = require('node:child_process');
+const { collectBuildFiles } = require('./build-manifest.cjs');
+
+const manifest = JSON.parse(fs.readFileSync('static/build-info.json', 'utf8'));
+const sourceCommit = execFileSync('git', ['rev-parse', 'HEAD'], {
+  encoding: 'utf8',
+}).trim();
+const lockfileSha256 = crypto
+  .createHash('sha256')
+  .update(fs.readFileSync('pnpm-lock.yaml'))
+  .digest('hex');
+if (
+  manifest.dirty !== false ||
+  manifest.sourceCommit !== sourceCommit ||
+  manifest.lockfileSha256 !== lockfileSha256
+) {
+  throw new Error(
+    'Build artifacts do not match the checked-out source and lockfile. Rebuild from the same clean commit.',
+  );
+}
+
+if (process.argv[2]) {
+  const dependencyLock = crypto
+    .createHash('sha256')
+    .update(fs.readFileSync(process.argv[2]))
+    .digest('hex');
+  if (dependencyLock !== manifest.lockfileSha256)
+    throw new Error(
+      'Production dependencies were built from a different lockfile.',
+    );
+}
+
+const actual = collectBuildFiles();
+if (
+  manifest.version !== 1 ||
+  !manifest.files ||
+  JSON.stringify(Object.keys(actual).sort()) !==
+    JSON.stringify(Object.keys(manifest.files).sort())
+)
+  throw new Error(
+    'Build output file set mismatch. Rebuild the complete artifacts.',
+  );
+for (const [file, hash] of Object.entries(actual)) {
+  if (hash !== manifest.files[file])
+    throw new Error(`Build output checksum mismatch: ${file}`);
+}
+console.log(`Verified build artifacts for ${sourceCommit}`);