feat: verify production runtime integrity

internal/diagnostics/acceptance_snapshot.go

@@ -85,6 +85,10 @@ type AcceptancePlatformHealthState struct {
 type AcceptanceProductionInfrastructureState struct {
 	Applicable                 bool   `json:"applicable"`
 	DeploymentProfile          string `json:"deployment_profile"`
+	ApplicationEnvironment     string `json:"application_environment"`
+	IdentityServiceMode        string `json:"identity_service_mode"`
+	ApplicationRuntimeReady    bool   `json:"application_runtime_ready"`
+	IdentityServiceReady       bool   `json:"identity_service_ready"`
 	OffsiteBackupReady         bool   `json:"offsite_backup_ready"`
 	ExternalAlertReceiverReady bool   `json:"external_alert_receiver_ready"`
 	MockServicesDisabled       bool   `json:"mock_services_disabled"`
@@ -385,7 +389,12 @@ func acceptancePlatformHealthSummary(state AcceptancePlatformHealthState) string
 }
 
 func evaluateAcceptanceProductionInfrastructure(environment string, checks []PlatformHealthCheck) AcceptanceProductionInfrastructureState {
-	state := AcceptanceProductionInfrastructureState{Applicable: environment == "PRODUCTION", DeploymentProfile: "MISSING"}
+	state := AcceptanceProductionInfrastructureState{
+		Applicable:             environment == "PRODUCTION",
+		DeploymentProfile:      "MISSING",
+		ApplicationEnvironment: "MISSING",
+		IdentityServiceMode:    "MISSING",
+	}
 	if !state.Applicable {
 		state.GateSatisfied = true
 		return state
@@ -396,6 +405,12 @@ func evaluateAcceptanceProductionInfrastructure(environment string, checks []Pla
 		case "deployment_profile":
 			state.DeploymentProfile = check.Value
 			profileReady = check.Status == "healthy" && check.Value == "production"
+		case "application_environment":
+			state.ApplicationEnvironment = check.Value
+			state.ApplicationRuntimeReady = check.Status == "healthy" && check.Value == "prod"
+		case "identity_service_mode":
+			state.IdentityServiceMode = check.Value
+			state.IdentityServiceReady = check.Status == "healthy" && check.Value == "hardened"
 		case "offsite_backup":
 			state.OffsiteBackupReady = check.Status == "healthy" && strings.HasPrefix(check.Value, "age_seconds=")
 		case "external_alert_receiver":
@@ -404,7 +419,7 @@ func evaluateAcceptanceProductionInfrastructure(environment string, checks []Pla
 			state.MockServicesDisabled = check.Status == "healthy" && check.Value == "disabled"
 		}
 	}
-	state.GateSatisfied = profileReady && state.OffsiteBackupReady && state.ExternalAlertReceiverReady && state.MockServicesDisabled
+	state.GateSatisfied = profileReady && state.ApplicationRuntimeReady && state.IdentityServiceReady && state.OffsiteBackupReady && state.ExternalAlertReceiverReady && state.MockServicesDisabled
 	return state
 }
 
@@ -412,10 +427,16 @@ func acceptanceProductionInfrastructureSummary(state AcceptanceProductionInfrast
 	if !state.Applicable {
 		return "非生产候选不适用生产基础设施强制门禁"
 	}
-	missing := make([]string, 0, 4)
+	missing := make([]string, 0, 6)
 	if state.DeploymentProfile != "production" {
 		missing = append(missing, "生产部署模式")
 	}
+	if !state.ApplicationRuntimeReady {
+		missing = append(missing, "生产应用运行环境")
+	}
+	if !state.IdentityServiceReady {
+		missing = append(missing, "非开发模式身份服务")
+	}
 	if !state.OffsiteBackupReady {
 		missing = append(missing, "已验证异地备份")
 	}
@@ -428,7 +449,7 @@ func acceptanceProductionInfrastructureSummary(state AcceptanceProductionInfrast
 	if len(missing) > 0 {
 		return "生产基础设施尚缺：" + strings.Join(missing, "、")
 	}
-	return "生产部署模式、异地备份、外部告警和模拟服务退出均已确认"
+	return "生产部署与应用环境、身份服务、异地备份、外部告警和模拟服务退出均已确认"
 }
 
 func acceptanceRuntimeSummary(environment string) string {