feat(httpapi): harden control plane and speed up prefix refresh

Очередь job получила lease и fencing, телеметрия и прогресс deploy сохраняются, ревизия пишет manifest входов. Обновление префиксов не переписывает неизменённый снимок, большие наборы идут через COPY, а устаревшая ревизия не попадает в deploy. Бандл ноды кэшируется, prune и постановка job больше не держат горячий путь.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/quality.yaml

@@ -322,6 +322,66 @@ jobs:
             go build -o "$out/$name" "./$d"
           done
 
+  postgres-integration:
+    needs: [changes]
+    if: needs.changes.outputs.go == 'true'
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: evobgp
+          POSTGRES_PASSWORD: evobgp_ci
+          POSTGRES_DB: evobgp_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U evobgp -d evobgp_test"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 12
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version: "1.24"
+          cache: false
+      - name: Export cache paths
+        run: sh scripts/ci/export-cache-env.sh
+      - id: go-hash
+        run: echo "key=$(sha256sum go.sum | awk '{print $1}')" >> "$GITHUB_OUTPUT"
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        with:
+          path: |
+            ${{ env.GOMODCACHE }}
+            ${{ env.GOCACHE }}
+          key: go-${{ runner.os }}-1.24-postgres-${{ steps.go-hash.outputs.key }}
+          restore-keys: |
+            go-${{ runner.os }}-1.24-postgres-
+      - name: Run migrations and verify PostgreSQL integration tests executed
+        env:
+          GOFLAGS: -mod=readonly
+          EVOBGP_TEST_DATABASE_URL: postgres://evobgp:evobgp_ci@127.0.0.1:5432/evobgp_test?sslmode=disable
+        run: bash scripts/ci/postgres-integration.sh
+
+  legacy-compatibility:
+    needs: [changes]
+    if: needs.changes.outputs.go == 'true'
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        legacy_version: ["2.56.2", "1.0.0"]
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version: "1.24"
+          cache: false
+      - name: Build pinned legacy executables and test current control plane
+        env:
+          EVOBGP_LEGACY_VERSION: ${{ matrix.legacy_version }}
+        run: bash scripts/ci/legacy-node-compatibility.sh
+
   bird2:
     runs-on: ubuntu-latest
     needs: [changes, go]
@@ -335,6 +395,10 @@ jobs:
        needs.changes.outputs.docker_go == 'true')
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version: "1.24"
+          cache: false
       - name: Install bird2 (репозиторий Ubuntu runner, как в образе evobgp-bird2)
         run: |
           set -euxo pipefail
@@ -358,6 +422,11 @@ jobs:
             echo "==> $conf"
             bird -c "$WS/$conf" -p
           done
+      - name: Parse staged birddeploy generation with real BIRD
+        env:
+          GOFLAGS: -mod=readonly
+          EVOBGP_TEST_BIRD_BIN: bird
+        run: go test ./internal/birddeploy -run '^TestRealBirdParseGeneration$' -count=1 -v
 
   commitlint:
     if: inputs.is_pull_request
@@ -405,6 +474,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Offline mirror behavior tests
+        run: bash scripts/tests/mirror-base-images.test.sh
       - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
         with:
           name: evobgp