fix(ops): bridge production metrics securely

scripts/ops/apply_metrics_edge_policy.py

@@ -28,6 +28,19 @@ def main() -> int:
     parser.add_argument("--run-id", required=True)
     parser.add_argument("--work-item-id", default="SEC-P0-001")
     parser.add_argument("--apply", action="store_true")
+    parser.add_argument(
+        "--apply-scope",
+        choices=("full", "prometheus_only"),
+        default="full",
+    )
+    parser.add_argument(
+        "--metrics-canary-url",
+        default="https://mo.wooo.work/metrics",
+    )
+    parser.add_argument(
+        "--metrics-canary-resolve",
+        default="mo.wooo.work:443:127.0.0.1",
+    )
     parser.add_argument("--canary-timeout", type=int, default=90)
     parser.add_argument("--receipt", type=Path)
     args = parser.parse_args()
@@ -43,6 +56,9 @@ def main() -> int:
     payload = apply_metrics_edge_plan(
         plan,
         canary_timeout=args.canary_timeout,
+        apply_scope=args.apply_scope,
+        metrics_canary_url=args.metrics_canary_url,
+        metrics_canary_resolve=args.metrics_canary_resolve,
     ) if args.apply else {key: value for key, value in plan.items() if not key.startswith("_")}
     output = json.dumps(payload, ensure_ascii=False, indent=2, sort_keys=True)
     if args.receipt: