fix(api): support runtime template copy receipt

docs/LOGBOOK.md

@@ -1,3 +1,12 @@
+## 2026-06-30 — 00:41 P0-004 template copy receipt runtime-image readback 修正
+
+**照優先順序完成的實作**：
+- production `/api/v1/agents/awoooi-gitea-onboarding-warning-step-template-copy-receipt` 已部署但回 `blocked_template_copy_receipt_invalid`，原因是 API image 依 `.dockerignore` 不包含 `.gitea`；runtime 看得到 source template，卻看不到 copied workflow path，造成 source-control receipt 假紅。
+- 新增 `docs/operations/awoooi-gitea-onboarding-warning-step-template-copy-receipt.snapshot.json`，把 source template / destination workflow / hash / fail-closed switch / no branch auto event / no generic runner label 收斂成會進 API image 的 committed receipt。
+- receipt service 現在支援兩種 layout：repo/local 直接比對 `.gitea/workflows/awoooi-onboarding-warning-step.yaml`；production image 若 `.gitea` 不可見，則以 docs receipt + source template hash 驗證 copy 已記錄且仍 fail-closed。
+
+**邊界**：未 workflow_dispatch，未改 runner，未操作 host / Docker / K8s / DB / firewall，未使用 GitHub / `gh` / GitHub API，未讀 secret / token / raw sessions / SQLite / `.env`。
+
 ## 2026-06-30 — 00:34 P1-LOG executor queue 納入 autonomous runtime-control
 
 **照主線完成的實作**：

docs/operations/awoooi-gitea-onboarding-warning-step-template-copy-receipt.snapshot.json

@@ -0,0 +1,26 @@
+{
+  "schema_version": "awoooi_gitea_onboarding_warning_step_template_copy_receipt_snapshot_v1",
+  "generated_at": "2026-06-30T00:42:00+08:00",
+  "workplan_id": "P0-004-TEMPLATE-COPY-CONTROLLED-APPLY",
+  "source_template_path": "docs/operations/templates/awoooi-gitea-onboarding-warning-step.workflow.yaml",
+  "destination_workflow_path": ".gitea/workflows/awoooi-onboarding-warning-step.yaml",
+  "source_template_content_sha256_12": "70ecac9e4b59",
+  "destination_workflow_content_sha256_12": "70ecac9e4b59",
+  "template_copy_recorded": true,
+  "destination_workflow_runtime_visible_required": false,
+  "runtime_image_excludes_dot_gitea": true,
+  "workflow_dispatch_declared": true,
+  "fail_closed_execution_switch_present": true,
+  "workflow_trigger_performed": false,
+  "auto_branch_event_count": 0,
+  "generic_runner_label_count": 0,
+  "runner_pressure_guard_required": true,
+  "hard_blockers_preserved": [
+    "no_push_or_pull_request_trigger_to_awoooi_runner",
+    "no_generic_runner_label",
+    "no_workflow_dispatch_from_this_receipt",
+    "no_github_api_or_gh",
+    "no_secret_or_token_read",
+    "no_host_or_k8s_write"
+  ]
+}