fix(cd): allow bounded rollout convergence

.gitea/workflows/cd.yaml

@@ -3083,11 +3083,13 @@ jobs:
             sleep 5
           done
 
-          # 確認 rollout 完成
-          $KUBECTL rollout status deployment/awoooi-api -n awoooi-prod --timeout=120s
-          $KUBECTL rollout status deployment/awoooi-web -n awoooi-prod --timeout=120s
-          $KUBECTL rollout status deployment/awoooi-worker -n awoooi-prod --timeout=120s
-          $KUBECTL rollout status deployment/awoooi-ansible-executor-broker -n awoooi-prod --timeout=120s
+          # Two-replica rollouts can legitimately need more than two minutes
+          # before the second replacement is available. Keep this bounded, but
+          # do not abort before the independent boundary verifier can run.
+          $KUBECTL rollout status deployment/awoooi-api -n awoooi-prod --timeout=300s
+          $KUBECTL rollout status deployment/awoooi-web -n awoooi-prod --timeout=300s
+          $KUBECTL rollout status deployment/awoooi-worker -n awoooi-prod --timeout=300s
+          $KUBECTL rollout status deployment/awoooi-ansible-executor-broker -n awoooi-prod --timeout=300s
           echo "✅ 部署完成"
 
           # AIA-P0-011: production must prove that the public API cannot mutate

apps/api/tests/test_executor_network_policy_boundary.py

@@ -224,6 +224,18 @@ def test_cd_concurrency_probe_degrades_to_terminal_false_receipt() -> None:
     assert "workload DB identity/budget remains in progress" in workflow
 
 
+def test_cd_allows_bounded_rollout_convergence_before_boundary_verifier() -> None:
+    repo_root = Path(__file__).resolve().parents[3]
+    workflow = (repo_root / ".gitea/workflows/cd.yaml").read_text()
+    rollout_gate = workflow.split("# Two-replica rollouts", 1)[1].split(
+        "# AIA-P0-011:", 1
+    )[0]
+
+    assert rollout_gate.count("--timeout=300s") == 4
+    assert "--timeout=120s" not in rollout_gate
+    assert "independent boundary verifier" in rollout_gate
+
+
 def test_broker_probe_accepts_partial_live_route_evidence(tmp_path: Path) -> None:
     result = _run_broker_probe(
         tmp_path,