fix(ci): prevent docker lock self match

.gitea/workflows/cd.yaml

@@ -349,7 +349,9 @@ jobs:
               # the Docker-network lock behind with no active build or push.
               # Waiting the full 30m CD timeout keeps deploys queued even
               # though no job is protected, so clear empty locks after 5m.
-              ACTIVE_DOCKER_WORK=$(ps -eo args | grep -E 'docker (build|push)|buildx build' | grep -v grep || true)
+              # 2026-05-12 Codex: 用 bracket pattern 避免 lock-check shell 自己的
+              # grep/awk pattern 被誤判成 active docker work，導致 empty lock 永不自清。
+              ACTIVE_DOCKER_WORK=$(ps -eo pid,args | awk '$0 ~ /[d]ocker (build|push)|[b]uildx build/ {print}' || true)
               if [ "$CREATED_EPOCH" -gt 0 ] && \
                  [ "$LOCK_AGE" -gt "$EMPTY_LOCK_SECONDS" ] && \
                  [ -z "$ACTIVE_DOCKER_WORK" ]; then

docs/LOGBOOK.md

@@ -5521,3 +5521,40 @@ DATABASE_URL='postgresql+asyncpg://test:test@127.0.0.1:5432/test' \
   apps/api/tests/test_cicd_alertmanager_mapping.py -q
 # 9 passed
 ```
+
+**生產驗收**：
+
+```text
+Gitea:
+1882 CD Pipeline -> success
+  tests -> success
+  build-and-deploy -> success
+  post-deploy-checks -> success
+
+K8s:
+awoooi-api    192.168.0.110:5000/awoooi/api:cb7151cc27ad7243995d4e12b3d5d14ef2958193 2/2
+awoooi-web    192.168.0.110:5000/awoooi/web:cb7151cc27ad7243995d4e12b3d5d14ef2958193 2/2
+awoooi-worker 192.168.0.110:5000/awoooi/api:cb7151cc27ad7243995d4e12b3d5d14ef2958193 1/1
+
+HTTP:
+/api/v1/health -> 200
+/zh-TW/awooop/runs -> 200
+
+AwoooP:
+/api/v1/platform/runs/list?per_page=10 -> total=3
+Run Detail timeline -> 含 TELEGRAM：AI 治理警報 outbound item
+
+Log:
+completed_shadow_run_created / outbound_message_recorded present
+未再見 telegram_outbound_mirror_failed / NotNullViolationError
+```
+
+**CD lock 追加修正**：
+
+- 本次 CD 因前一輪取消留下 `awoooi-cd-docker-build-lock`，且 lock-check 內的
+  `grep -E 'docker (build|push)|buildx build'` 會誤匹配自己的 shell 文字，導致
+  empty lock 無法自清。
+- 已手動確認 110 無 active docker build/push 後移除孤兒 lock，讓 1882 繼續部署。
+- `cd.yaml` 改用 awk bracket pattern：
+  `awk '$0 ~ /[d]ocker (build|push)|[b]uildx build/ {print}'`
+  避免自我匹配。