fix(ai): block observe-only playbooks from auto repair

apps/api/src/services/auto_repair_service.py

@@ -468,6 +468,23 @@ class AutoRepairService:
                 blocked_by="HOST_BACKUP_K8S_PLAYBOOK",
             )
 
+        if not self._playbook_has_mutating_steps(best_match.playbook):
+            logger.warning(
+                "auto_repair_blocked_observe_only_playbook",
+                incident_id=incident.incident_id,
+                playbook_id=best_match.playbook.playbook_id,
+            )
+            return AutoRepairDecision(
+                can_auto_repair=False,
+                playbook=best_match.playbook,
+                reason=(
+                    "PlayBook 只有診斷 / 觀測步驟，不能宣稱自動修復；"
+                    "請轉成 Work Item 補真正修復步驟或 gated Ansible apply"
+                ),
+                risk_level=max_risk or RiskLevel.MEDIUM,
+                blocked_by="OBSERVE_ONLY_PLAYBOOK",
+            )
+
         # 5. 可以自動修復
         logger.info(
             "auto_repair_approved",
@@ -936,6 +953,33 @@ class AutoRepairService:
                 return True
         return False
 
+    def _playbook_has_mutating_steps(self, playbook: Playbook) -> bool:
+        """Return true only when a PlayBook contains an actual repair action."""
+
+        for step in playbook.repair_steps:
+            command = (step.command or "").strip().lower()
+            if not command or step.action_type == ActionType.MANUAL:
+                continue
+            if step.action_type == ActionType.KUBECTL or command.startswith("kubectl "):
+                if not command.startswith((
+                    "kubectl get ",
+                    "kubectl describe ",
+                    "kubectl logs ",
+                    "kubectl top ",
+                    "kubectl explain ",
+                )):
+                    return True
+                continue
+            if step.action_type == ActionType.SSH_COMMAND:
+                if command.startswith(("openclaw://", "ansible://")):
+                    return True
+                if any(token in command for token in _SSH_WRITE_KEYWORDS):
+                    return True
+                continue
+            if step.action_type == ActionType.SCRIPT:
+                return True
+        return False
+
     def _playbook_is_k3s_node_repair(self, playbook: Playbook) -> bool:
         """K3s node repair must only run for actual K3s node alerts."""