Add safe artifact migration and status fixes

scripts/real_host_acceptance.sh

@@ -6,6 +6,8 @@ TIMESTAMP="$(date +%Y%m%d_%H%M%S)"
 ARTIFACT_DIR="${ARTIFACT_DIR:-$ROOT_DIR/artifacts/real-host-acceptance/$TIMESTAMP}"
 DRY_RUN="${DRY_RUN:-0}"
 SKIP_ROLLBACK="${SKIP_ROLLBACK:-0}"
+ARTIFACT_SECURITY_MODE="${ARTIFACT_SECURITY_MODE:-safe}"
+ARTIFACT_INCLUDE_SECRETS="${ARTIFACT_INCLUDE_SECRETS:-0}"
 
 require_var() {
   local name="$1"
@@ -43,11 +45,20 @@ save_json() {
   printf '%s\n' "$payload" > "$ARTIFACT_DIR/$name.json"
 }
 
+artifact_redact_key_json() {
+  local value="$1"
+  python3 "$ROOT_DIR/scripts/artifact_redaction.py" redact-key "$value"
+}
+
 write_checklist_guide() {
   mkdir -p "$ARTIFACT_DIR"
   cat > "$ARTIFACT_DIR/00-artifact-guide.txt" <<EOF
 真实宿主验收产物 -> 速查清单对应
 
+artifact security mode: $ARTIFACT_SECURITY_MODE
+contains raw secrets: $( [[ "$ARTIFACT_INCLUDE_SECRETS" == "1" ]] && printf 'yes' || printf 'no' )
+repository-safe: $( [[ "$ARTIFACT_SECURITY_MODE" == "safe" && "$ARTIFACT_INCLUDE_SECRETS" != "1" ]] && printf 'yes' || printf 'no' )
+
 清单 1（环境 / host 前置）
 - 01-create-host.json
 - 02-probe-host.json