feat(ai): verify canonical learning writeback

.gitea/workflows/cd.yaml

@@ -2400,6 +2400,9 @@ jobs:
                   "AWOOOI_BUILD_COMMIT_SHA",
                   "AWOOOI_DESIRED_API_IMAGE_TAG",
               ),
+              Path("k8s/awoooi-prod/08-deployment-worker.yaml"): (
+                  "AWOOOI_BUILD_COMMIT_SHA",
+              ),
               Path(
                   "k8s/awoooi-prod/08-deployment-ansible-executor-broker.yaml"
               ): ("AWOOOI_BUILD_COMMIT_SHA",),
@@ -2417,6 +2420,7 @@ jobs:
           git add \
             k8s/awoooi-prod/kustomization.yaml \
             k8s/awoooi-prod/06-deployment-api.yaml \
+            k8s/awoooi-prod/08-deployment-worker.yaml \
             k8s/awoooi-prod/08-deployment-ansible-executor-broker.yaml
           DEPLOY_REVISION=""
           git diff --cached --quiet && echo "⚡ kustomization.yaml 無變化，跳過 push" || {
@@ -3167,6 +3171,13 @@ jobs:
             --from-literal=verifier_failure_marks_apply_failed=true \
             --from-literal=verifier_failure_retry_first=true \
             --from-literal=post_verifier_raw_output_not_persisted=true \
+            --from-literal=canonical_learning_source_verifier=cd_tests_and_production_source_sha_v1 \
+            --from-literal=canonical_playbook_resolver_complete=true \
+            --from-literal=km_row_readback_required=true \
+            --from-literal=playbook_row_readback_required=true \
+            --from-literal=learning_failure_fail_closed=true \
+            --from-literal=trust_failure_fail_closed=true \
+            --from-literal=learning_receipts_public_safe=true \
             --from-literal=db_identity_verifier=runtime_role_fingerprint_secret_projection_and_representative_preflight_v2 \
             --from-literal=api_database_secret_ref="$API_DATABASE_SECRET_REF" \
             --from-literal=worker_database_secret_ref="$WORKER_DATABASE_SECRET_REF" \
@@ -3281,6 +3292,10 @@ jobs:
                       )
                       or {}
                   )
+                  canonical_learning_source_boundary = (
+                      boundary.get("canonical_learning_source_boundary")
+                      or {}
+                  )
                   last_status = str(boundary.get("status") or "missing")
                   if (
                       boundary.get("production_boundary_verified") is True
@@ -3293,6 +3308,9 @@ jobs:
                       and independent_post_verifier_source_boundary.get(
                           "source_boundary_verified"
                       ) is True
+                      and canonical_learning_source_boundary.get(
+                          "source_boundary_verified"
+                      ) is True
                       and str(boundary.get("verified_source_sha") or "").lower()
                       == expected
                   ):