feat(ci): copy onboarding warning-step template

apps/api/src/api/v1/agents.py

@@ -319,6 +319,9 @@ from src.services.ai_technology_report_cadence_readback import (
 from src.services.awoooi_gitea_onboarding_warning_step_template_copy_apply_gate import (
     load_latest_awoooi_gitea_onboarding_warning_step_template_copy_apply_gate,
 )
+from src.services.awoooi_gitea_onboarding_warning_step_template_copy_execution_plan import (
+    load_latest_awoooi_gitea_onboarding_warning_step_template_copy_execution_plan,
+)
 from src.services.awoooi_status_cleanup_dashboard import (
     load_latest_awoooi_status_cleanup_dashboard,
 )
@@ -1128,6 +1131,37 @@ async def get_awoooi_gitea_onboarding_warning_step_template_copy_apply_gate() ->
         ) from exc
 
 
+@router.get(
+    "/awoooi-gitea-onboarding-warning-step-template-copy-execution-plan",
+    response_model=dict[str, Any],
+    summary="取得 AWOOOI Gitea onboarding warning-step template copy execution plan",
+    description=(
+        "讀取 P0-004 warning-step template copy 的受控 execution plan；"
+        "此端點只回傳 committed template-copy plan readiness。"
+        "它不複製 workflow、不觸發 workflow、不建立 repo、不同步 refs、"
+        "不呼叫 GitHub、不讀 secret、不操作 host / K8s。"
+    ),
+)
+async def get_awoooi_gitea_onboarding_warning_step_template_copy_execution_plan() -> dict[
+    str, Any
+]:
+    """回傳 P0-004 warning-step template copy execution plan 只讀讀回。"""
+    try:
+        payload = await asyncio.to_thread(
+            load_latest_awoooi_gitea_onboarding_warning_step_template_copy_execution_plan
+        )
+        return redact_public_lan_topology(payload)
+    except (json.JSONDecodeError, ValueError) as exc:
+        logger.error(
+            "awoooi_gitea_onboarding_warning_step_template_copy_execution_plan_invalid",
+            error=str(exc),
+        )
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail="P0-004 warning-step template copy execution plan 無效",
+        ) from exc
+
+
 @router.get(
     "/reboot-auto-recovery-slo-scorecard",
     response_model=dict[str, Any],

apps/api/src/services/awoooi_gitea_onboarding_warning_step_template_copy_execution_plan.py

@@ -10,25 +10,58 @@ _SCHEMA_VERSION = "awoooi_gitea_onboarding_warning_step_template_copy_execution_
 
 
 def load_latest_awoooi_gitea_onboarding_warning_step_template_copy_execution_plan() -> dict[str, Any]:
-    """Return the dry-run-only template copy plan source."""
+    """Return the controlled template copy plan source."""
     return source_ready_payload(
         schema_version=_SCHEMA_VERSION,
         source_id="warning_step_template_copy_execution_plan_service",
-        status="dry_run_plan_ready_apply_gate_required",
+        status="controlled_template_copy_execution_plan_ready",
         readback={
-            "execution_status": "blocked_apply_gate_required",
-            "dry_run_only": True,
+            "execution_status": "ready_for_controlled_template_copy",
+            "dry_run_only": False,
+            "controlled_apply_scope": "warning_step_template_copy_only",
+            "source_template_path": (
+                "docs/operations/templates/"
+                "awoooi-gitea-onboarding-warning-step.workflow.yaml"
+            ),
+            "destination_workflow_path": (
+                ".gitea/workflows/awoooi-onboarding-warning-step.yaml"
+            ),
             "command_preview_count": 1,
             "command_preview": [
-                "copy warning-step template after apply gate confirms source readiness"
+                (
+                    "cp docs/operations/templates/"
+                    "awoooi-gitea-onboarding-warning-step.workflow.yaml "
+                    ".gitea/workflows/awoooi-onboarding-warning-step.yaml"
+                )
+            ],
+            "template_runtime_default": "fail_closed_job_disabled",
+            "forbidden_events": [
+                "push",
+                "pull_request",
+                "pull_request_target",
+            ],
+            "forbidden_runner_labels": [
+                "awoooi-host",
+                "awoooi-ubuntu",
+                "ubuntu-latest",
+                "ubuntu-*",
+                "self-hosted",
+            ],
+            "allowed_runner_labels": [
+                "awoooi-non110-host",
             ],
             "post_copy_validators": [
                 "python3 ops/runner/guard-gitea-runner-pressure.py --root .",
                 "git diff --check",
             ],
+            "rollback_plan": (
+                "remove .gitea/workflows/awoooi-onboarding-warning-step.yaml "
+                "before commit"
+            ),
         },
         next_actions=[
-            "open_template_copy_apply_gate",
-            "do_not_copy_workflow_until_apply_gate_allows",
+            "copy_warning_step_template_with_fail_closed_runtime_default",
+            "run_runner_pressure_guard_and_git_diff_check",
+            "do_not_trigger_workflow_until_next_controlled_gate",
         ],
     )