feat(runtime): harden daily pipeline audit and verification

Tighten real-ingestion success rules, separate scheduled reports from historical rebuilds, and persist source-level runtime audit across daily pipeline runs.

Also add the Phase 5 CI workflow contract plus verification updates and supporting docs so the full uncommitted change set can be validated together.

scripts/fetch_openrouter.go

@@ -33,6 +33,7 @@ type Config struct {
 	TimeoutSec int
 	BatchSize  int
 	DBConn     string
+	StrictReal bool
 }
 
 // ModelInfo 模型信息（与 collectors 包兼容）
@@ -99,6 +100,7 @@ func parseArgs() Config {
 	timeoutSec := flag.Int("timeout", 30, "请求超时（秒）")
 	batchSize := flag.Int("batch", 100, "批量插入批次大小")
 	dbConn := flag.String("db", os.Getenv("DATABASE_URL"), "PostgreSQL 连接字符串")
+	strictReal := flag.Bool("strict-real", false, "严格真实模式：缺少 API Key 或数据库写入失败时返回错误")
 	flag.Parse()
 	return Config{
 		APIKey:     *apiKey,
@@ -108,6 +110,7 @@ func parseArgs() Config {
 		TimeoutSec: *timeoutSec,
 		BatchSize:  *batchSize,
 		DBConn:     *dbConn,
+		StrictReal: *strictReal,
 	}
 }
 
@@ -158,6 +161,9 @@ func run(cfg Config) error {
 	if cfg.DBConn != "" {
 		if err := summarizeDB(cfg.DBConn, models, cfg.BatchSize); err != nil {
 			logger.Error("PostgreSQL 写入失败", "error", err)
+			if cfg.StrictReal {
+				return fmt.Errorf("PostgreSQL 写入失败: %w", err)
+			}
 			logger.Warn("降级为仅写入 JSON")
 		} else {
 			logger.Info("PostgreSQL 写入完成", "records", len(models))
@@ -169,6 +175,9 @@ func run(cfg Config) error {
 // fetchModels 抓取 OpenRouter 模型列表（集成指数退避重试）
 func fetchModels(cfg Config) ([]ModelInfo, error) {
 	if cfg.APIKey == "" {
+		if cfg.StrictReal {
+			return nil, fmt.Errorf("严格真实模式下必须提供 API Key")
+		}
 		logger.Warn("未提供 API Key，使用模拟数据")
 		return []ModelInfo{
 			{ID: "openai/gpt-4o", ContextLength: 128000, Pricing: ModelPricing{Input: 2.5, Output: 10.0}},