fix(iwooos): repair wazuh host trust and retry

.gitea/workflows/cd.yaml

@@ -2108,15 +2108,15 @@ jobs:
           # asyncssh reads /etc/ssh-mcp/known_hosts and requires a non-empty
           # OpenSSH known_hosts file. Keep hosts unhashed so both asyncssh and
           # CLI diagnostics can trust the same secret.
-          # 2026-05-02 ogt + Claude Sonnet 4.6: 加 4 台主機完整性檢查
+          # 2026-05-02 ogt + Claude Sonnet 4.6: 加主機完整性檢查
           # 根因：partial scan（如 110 timeout、其他成功）會讓 [-s file] 通過、
           #       後續 patch 推進缺漏的 known_hosts → asyncssh 拒所有 SSH。
-          # 修法：scan 完用 grep -c 驗證 4 台主機都在；缺任何一台就 abort，
+          # 修法：scan 完驗證所有 allowlisted 主機都在；缺任何一台就 abort，
           #       不能覆蓋現有 secret，防止 production SSH 自動修復路徑癱瘓。
-          ssh-keyscan 192.168.0.110 192.168.0.120 192.168.0.121 192.168.0.188 > /tmp/known_hosts_repair 2>/tmp/known_hosts_scan_err || true
-          EXPECTED_HOSTS=4
+          ssh-keyscan 192.168.0.110 192.168.0.112 192.168.0.120 192.168.0.121 192.168.0.188 > /tmp/known_hosts_repair 2>/tmp/known_hosts_scan_err || true
+          EXPECTED_HOSTS=5
           PRESENT=0
-          for ip in 192.168.0.110 192.168.0.120 192.168.0.121 192.168.0.188; do
+          for ip in 192.168.0.110 192.168.0.112 192.168.0.120 192.168.0.121 192.168.0.188; do
             if grep -qE "^\${ip}[[:space:]]" /tmp/known_hosts_repair 2>/dev/null; then
               PRESENT=\$((PRESENT + 1))
             else
@@ -2133,13 +2133,14 @@ jobs:
             KNOWN_HOSTS_B64=\$(base64 -w 0 /tmp/known_hosts_repair)
             \$KUBECTL patch secret ssh-mcp-key -n awoooi-prod --type=merge \
               -p="{\"data\":{\"known_hosts\":\"\${KNOWN_HOSTS_B64}\"}}" \
-              && echo "✅ ssh-mcp-key known_hosts 已更新（4 台主機完整）" \
-              || echo "⚠️ ssh-mcp-key known_hosts 更新失敗 (非致命)"
+              && echo "✅ ssh-mcp-key known_hosts 已更新（5 台主機完整）" \
+              || { echo "❌ ssh-mcp-key known_hosts 更新失敗，停止部署"; exit 1; }
             rm -f /tmp/known_hosts_repair /tmp/known_hosts_scan_err
           else
             echo "❌ ssh-keyscan 只抓到 \${PRESENT}/\${EXPECTED_HOSTS} 台主機，跳過 patch（保留現有 secret）"
             cat /tmp/known_hosts_scan_err 2>/dev/null | head -10
             rm -f /tmp/known_hosts_repair /tmp/known_hosts_scan_err
+            exit 1
           fi
 
           echo "✅ 所有 Secrets 注入完成"
@@ -2767,7 +2768,7 @@ jobs:
             container="$2"
             $KUBECTL exec -i "deployment/$workload" -n awoooi-prod \
               -c "$container" -- python - \
-              192.168.0.110 192.168.0.120 192.168.0.121 192.168.0.188 <<'PY'
+              192.168.0.110 192.168.0.112 192.168.0.120 192.168.0.121 192.168.0.188 <<'PY'
           import socket
           import sys
 
@@ -2787,7 +2788,7 @@ jobs:
           verify_broker_ssh_allowed() {
             $KUBECTL exec -i deployment/awoooi-ansible-executor-broker \
               -n awoooi-prod -c broker -- python - \
-              192.168.0.110 192.168.0.120 192.168.0.121 192.168.0.188 <<'PY'
+              192.168.0.110 192.168.0.112 192.168.0.120 192.168.0.121 192.168.0.188 <<'PY'
           import socket
           import sys
 
@@ -2801,7 +2802,7 @@ jobs:
                   connection.close()
                   reachable.append(host)
           print("broker_ssh_reachable=" + ",".join(reachable))
-          raise SystemExit(0 if reachable else 1)
+          raise SystemExit(0 if len(reachable) == len(sys.argv) - 1 else 1)
           PY
           }
           verify_ssh_denied awoooi-api api || {