fix(alerts): preserve bare metal domain guard

apps/api/src/services/decision_manager.py

@@ -1899,6 +1899,7 @@ class DecisionManager:
         """
         action = token.proposal_data.get("kubectl_command", "") or token.proposal_data.get("action", "")
         _alert_labels = incident.signals[0].labels if incident.signals else {}
+        _host_type_for_domain_guard = (_alert_labels.get("host_type") or "").lower()
 
         # 2026-05-02 ogt + Claude Sonnet 4.6: YAML 是權威，先覆蓋 LLM 生成的 action
         # 根因：LLM/Phase2 會先產出 node-exporter/kubectl 的錯域建議，導致
@@ -1948,17 +1949,32 @@ class DecisionManager:
 
                     _yaml_cmd = (_yaml_r.get("kubectl_command") or "").strip()
                     if _yaml_cmd and not _yaml_cmd.startswith("kubectl"):
-                        # YAML 給出 SSH / docker 指令 → 覆蓋 LLM 生成的 action
-                        action = _yaml_cmd
-                        token.proposal_data["action"] = action
-                        token.proposal_data["kubectl_command"] = action
-                        await self._save_token(token)
-                        logger.info(
-                            "auto_execute_yaml_cmd_override",
-                            incident_id=incident.incident_id,
-                            alertname=_alertname_for_yaml,
-                            yaml_cmd=action[:80],
-                        )
+                        if (
+                            _host_type_for_domain_guard == "bare_metal"
+                            and action.lstrip().lower().startswith("kubectl")
+                        ):
+                            # 2026-05-31 ogt + Codex: 保留 bare_metal × kubectl
+                            # wrong-domain guard 的明確 blocked_reason，不用 YAML SSH
+                            # 診斷覆蓋掉 LLM 原始錯域提案。
+                            logger.info(
+                                "auto_execute_yaml_override_skipped_bare_metal_kubectl_guard",
+                                incident_id=incident.incident_id,
+                                alertname=_alertname_for_yaml,
+                                yaml_cmd=_yaml_cmd[:80],
+                                original_action=action[:80],
+                            )
+                        else:
+                            # YAML 給出 SSH / docker 指令 → 覆蓋 LLM 生成的 action
+                            action = _yaml_cmd
+                            token.proposal_data["action"] = action
+                            token.proposal_data["kubectl_command"] = action
+                            await self._save_token(token)
+                            logger.info(
+                                "auto_execute_yaml_cmd_override",
+                                incident_id=incident.incident_id,
+                                alertname=_alertname_for_yaml,
+                                yaml_cmd=action[:80],
+                            )
             except Exception as _yaml_err:
                 logger.debug("auto_execute_yaml_check_error", error=str(_yaml_err))
 
@@ -1969,7 +1985,7 @@ class DecisionManager:
         #       重啟 awoooi 服務根本解不了第三方 CPU 燒爆，只是拖累自己。
         # 修法：偵測到 alert host_type=bare_metal 且 action 是 kubectl 類，立即降級人工，
         #       Telegram 明示「跨 domain 動作被攔下」。auto_repair 走 SSH 診斷或人工。
-        _host_type = (_alert_labels.get("host_type") or "").lower()
+        _host_type = _host_type_for_domain_guard
         _action_stripped = action.lstrip().lower()
         if _host_type == "bare_metal" and _action_stripped.startswith("kubectl"):
             logger.warning(