feat(deploy): gencode 纳入 server 发版产物 + EC2 生码封装

server 流水线编译并发布 jiu-gencode 二进制（回滚路径随 release 资产
自动下载），部署到 /opt/jiu/backend/，对旧版回滚做存在性判断优雅跳过。
新增 deploy/jiu-gencode.sh 封装自动读 production.env，线上生码从此
一条 ssh 即可，无需本地交叉编译 + scp。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y2Wdwo7SmgBJU37cBrkhPK

scripts/ci/compile-backend.sh

@@ -13,10 +13,14 @@ echo "==> compile-backend: tag=${TAG}"
 # Build Go backend (linux/amd64 for EC2)
 cd backend
 GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o jiu-server .
+# Platform code-minting CLI (gencode) ships alongside the server so codes can be
+# minted on EC2 without cross-compiling/scp each time.
+GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o jiu-gencode ./cmd/gencode
 cd ..
 
 mkdir -p dist
 mv backend/jiu-server dist/jiu-server
+mv backend/jiu-gencode dist/jiu-gencode
 
 # Shared infrastructure (nginx/systemd/env/compose). version.yaml is NOT here —
 # it belongs to the client pipeline.
@@ -26,7 +30,8 @@ tar -czf dist/configs.tar.gz \
   deploy/production.env.template \
   deploy/setup-ec2.sh \
   deploy/docker-compose.yml \
-  deploy/docker-compose.jiu.yml
+  deploy/docker-compose.jiu.yml \
+  deploy/jiu-gencode.sh
 
 echo "==> compile-backend: done — dist/ contents:"
 ls -lh dist/

scripts/ci/deploy-server.sh

@@ -27,6 +27,13 @@ echo "==> deploy-server: uploading files to EC2"
 ${SCP} dist/jiu-server "${EC2_USER}@${EC2_HOST}:/tmp/jiu-server"
 ${SCP} /tmp/jiu-configs/deploy/nginx-jiu.conf "${EC2_USER}@${EC2_HOST}:/tmp/nginx-jiu.conf"
 
+# Platform code-minting CLI + wrapper (absent when rolling back to a pre-gencode
+# release — upload only when present).
+if [ -f dist/jiu-gencode ]; then
+  ${SCP} dist/jiu-gencode "${EC2_USER}@${EC2_HOST}:/tmp/jiu-gencode"
+  ${SCP} /tmp/jiu-configs/deploy/jiu-gencode.sh "${EC2_USER}@${EC2_HOST}:/tmp/jiu-gencode.sh"
+fi
+
 ${SSH} "${EC2_USER}@${EC2_HOST}" << 'ENDSSH'
 set -e
 
@@ -35,6 +42,17 @@ sudo systemctl stop jiu
 cp /tmp/jiu-server /opt/jiu/backend/jiu-server
 chmod +x /opt/jiu/backend/jiu-server
 
+# Refresh the code-minting CLI if shipped in this release (skip gracefully on
+# rollback to a pre-gencode release). Not a service — just a host-side binary.
+if [ -f /tmp/jiu-gencode ]; then
+  cp /tmp/jiu-gencode /opt/jiu/backend/jiu-gencode
+  chmod +x /opt/jiu/backend/jiu-gencode
+  if [ -f /tmp/jiu-gencode.sh ]; then
+    cp /tmp/jiu-gencode.sh /opt/jiu/backend/jiu-gencode.sh
+    chmod +x /opt/jiu/backend/jiu-gencode.sh
+  fi
+fi
+
 # Start and health check
 sudo systemctl start jiu
 echo "Waiting for health check..."

scripts/ci/release-server.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # release-server.sh <tag>  —  create the Forgejo Release for the backend pipeline
-# and upload jiu-server + configs.tar.gz.
+# and upload jiu-server + jiu-gencode + configs.tar.gz.
 set -euo pipefail
 
 # shellcheck source=scripts/ci/lib-forgejo.sh
@@ -20,6 +20,7 @@ PYEOF
 
 create_release "$TAG" "$BODY"
 upload_asset dist/jiu-server
+upload_asset dist/jiu-gencode
 upload_asset dist/configs.tar.gz
 
 echo "==> release-server: done — Release ${TAG} created"