fix(reboot): detect public maintenance edge drift

ops/monitoring/alerts-unified.yml

@@ -1169,6 +1169,22 @@ groups:
           description: "重啟或 upstream failure 期間 public route 仍露出 5xx；應由 L0 Nginx maintenance fallback 或 L1 external cloud/CDN 維護頁接手。"
           runbook: "依 docs/runbooks/PUBLIC-MAINTENANCE-FALLBACK-RUNBOOK.md 部署 ops/maintenance/maintenance.html 與 Nginx 502/503/504 intercept；整段 edge unreachable 時啟用外部 CDN/static fallback。"
 
+      - alert: PublicMaintenanceEdgeFallbackConfigDrift
+        expr: awoooi_public_maintenance_edge_fallback_ready{scope="public_routes"} == 0
+        for: 3m
+        labels:
+          severity: critical
+          layer: external
+          component: public-maintenance-fallback
+          team: ops
+          alert_category: reboot_recovery
+          notification_type: TYPE-3
+          auto_repair: "false"
+        annotations:
+          summary: "Public maintenance L0 edge fallback 尚未套用"
+          description: "SLO exporter 已讀到 live edge Nginx / maintenance file 尚未具備 502/503/504 fallback；部署或重啟期間會露出 raw 5xx。"
+          runbook: "先讀最新 /home/wooo/reboot-recovery/reboot-auto-recovery-slo-*/public-maintenance-edge-fallback.txt；只允許 public-maintenance-edge-fallback-apply.sh --check 或具備 passwordless sudo 的受控 --apply + nginx -t + header verifier，不得重啟 app / Docker / host。"
+
       - alert: ExternalSiteSSLExpiringSoon
         expr: probe_ssl_earliest_cert_expiry{job="blackbox-http"} - time() < 14 * 24 * 3600
         for: 1h