feat(wave6-8): P2.1 fusion + P2.2 governance + P2.4 consensus + Wave 7/8 BLOCKER 修復

承接 Wave 6/7/8 多 engineer 在 agent 限額前完成的代碼，補 commit 解 production
HEAD 隱性 import error（decision_fusion 已被 decision_manager 引用但檔案 untracked）。

新增（後端核心）:
- decision_fusion.py (562 行) — P2.1 方法 III（OpenClaw + Hermes + Elephant 三 LLM 融合）
- aiops_timeline.py + aiops_timeline_service.py — critic B4 修復
  /api/v1/aiops/timeline endpoint，DB 存取抽到 service 層遵守 leWOOOgo 積木化
- migrations/p2_decision_fusion_columns.sql + rollback — approval_records fusion 欄位

修改（後端整合）:
- decision_manager.py — fusion 三斷鏈修補（critic B1+B2+B3）：
  · B1: 寫 _evidence_snapshot_ref 到 token.proposal_data
  · B2: fusion 前計算 complexity_score 並寫 token
  · B3: fusion composite 寫 token.proposal_data["decision_fusion"]
- auto_approve.py — fusion + consensus 認識（critic B3+B5）：
  · composite > 0.7 → auto_execute_eligible bypass min_confidence
  · source=consensus_engine + score>=0.6 → 規則可信路徑
- consensus_engine.py — db-fix _save_consensus 重用 agent_sessions
- governance_agent.py — db-fix _alert PG 寫入 ai_governance_events
- approval_db.py — fusion 3 欄位 + 2 partial index + CheckConstraint
- db/models.py — schema 對齊 migration
- core/config.py — vuln #1 修復：OLLAMA_URL/_FALLBACK_URL field_validator
  拒絕公網 IP + 外部域名，僅允許私網/loopback/K8s SVC 白名單
- core/feature_flags.py — P2 fusion + consensus flags
- main.py — governance_agent lifespan 啟動
- failover_alerter.py — Wave8-X2: in-memory dedup fallback（Redis 拒絕後不 fail-open）
- ollama_*.py — metrics 整合 + recovery 改善
- auto_repair_service.py — verifier 接線

新增（測試 2438 行）:
- test_decision_fusion.py / test_governance_agent.py / test_consensus_integration.py
- test_p2_db_fixes.py / test_wave8_fusion_fixes.py
- test_config_url_validation.py（vuln #1 12 tests）
- test_failover_alerter.py +Wave8-X2 in-memory dedup 補測

驗收: 116 tests pass (decision_fusion + wave8_fusion + config_url + consensus +
                      governance + p2_db_fixes + failover_alerter)

Conflict resolution:
- 3 檔（config.py + auto_approve.py + decision_manager.py）git stash pop 衝突
  保留 stashed (engineer 最終版)，補回 ValueError 「公網 IP」字樣對齊 test

Note: 此 commit 解 production HEAD 隱性 import error
仍未修: vuln #4 prompt injection / debugger B14 quota fail-closed
       / B25-B26 drain_pending_tasks / B8 governance fail alert

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Multiple Engineers (Wave 6/7/8) <noreply@anthropic.com>

apps/api/src/main.py

@@ -37,6 +37,7 @@ from src.api.v1 import ai as ai_v1
 from src.api.v1 import aider_events as aider_events_v1  # aider-watch v2 ADR-091
 from src.api.v1 import ai_slo as ai_slo_v1  # Phase 6 ADR-087: AI SLO 自我治理
 from src.api.v1 import aiops_kpi as aiops_kpi_v1  # ADR-090 § Phase 7 KPI Dashboard
+from src.api.v1 import aiops_timeline as aiops_timeline_v1  # 2026-04-27 Wave8-X3 B4 timeline endpoint
 from src.api.v1 import approvals as approvals_v1
 from src.api.v1 import alert_operation_logs as alert_operation_logs_v1
 from src.api.v1 import audit_logs as audit_logs_v1
@@ -601,6 +602,18 @@ async def lifespan(_app: FastAPI) -> AsyncGenerator[None, None]:
     except Exception as e:
         logger.warning("ollama_failover_system_stop_failed", error=str(e))
 
+    # 2026-04-27 Wave8-X3 by Claude — B25/B26 drain fix
+    # K8s rolling restart：等待 auto_repair fire-and-forget tasks 完成後再關閉
+    # 確保 _verify_and_learn / runbook_generator 寫入不被 SIGTERM cancel
+    try:
+        from src.services.auto_repair_service import get_auto_repair_service
+        _repair_svc = get_auto_repair_service()
+        if hasattr(_repair_svc, "drain_pending_tasks"):
+            _drain_result = await _repair_svc.drain_pending_tasks(timeout=60.0)
+            logger.info("auto_repair_drain_complete", **_drain_result)
+    except Exception as e:
+        logger.warning("auto_repair_drain_failed", error=str(e))
+
     # Phase 6.1: 關閉 Signal Worker (先關閉 Consumer)
     await close_signal_worker()
     await publisher.stop()
@@ -759,6 +772,7 @@ app.include_router(approvals_v1.router, prefix="/api/v1", tags=["HITL Approvals"
 app.include_router(ai_v1.router, prefix="/api/v1", tags=["AI Decision"])
 app.include_router(ai_slo_v1.router, prefix="/api/v1", tags=["AI SLO"])  # Phase 6 ADR-087
 app.include_router(aiops_kpi_v1.router, prefix="/api/v1", tags=["AIOps KPI"])  # ADR-090 § Phase 7 Dashboard
+app.include_router(aiops_timeline_v1.router, prefix="/api/v1", tags=["AIOps Timeline"])  # 2026-04-27 Wave8-X3 B4
 app.include_router(webhooks_v1.router, prefix="/api/v1", tags=["Webhooks"])
 app.include_router(timeline_v1.router, prefix="/api/v1", tags=["Timeline"])
 app.include_router(audit_logs_v1.router, prefix="/api/v1", tags=["Audit Logs"])