fix(deploy): make manager release build context complete

infra/deploy-runner/build-device-manager-control-plane-artifact.mjs

@@ -12,7 +12,7 @@ const devicePlaneRoot = resolve(platformRoot, "device-plane");
 const designRoot = resolve(process.env.NODEDC_DEVICE_MANAGER_SOURCE_ROOT || resolve(platformRoot, "../NODEDC_DESIGN_GUIDELINE"));
 const managerRoot = resolve(designRoot, "apps/device-manager");
 const artifactDir = resolve(process.env.NODEDC_DEPLOY_ARTIFACT_DIR || resolve(scriptDir, "../deploy-artifacts"));
-const [patchId = "device-manager-release-20260811-014", ...extra] = process.argv.slice(2);
+const [patchId = "device-manager-release-20260811-015", ...extra] = process.argv.slice(2);
 if (extra.length || !/^[A-Za-z0-9._-]{1,96}$/.test(patchId)) throw new Error("usage: build-device-manager-control-plane-artifact.mjs [patch-id]");
 
 const entries = [
@@ -22,10 +22,13 @@ const entries = [
   "docker-compose.device-manager.yml",
   "packages/device-protocol-contract",
   "packages/device-edge-channel-contract",
+  "packages/device-adapter-runtime/package.json",
+  "packages/device-adapter-catalog/package.json",
   "packages/arusnavi-b2-adapter",
   "services/device-control-core",
   "services/device-gateway/package.json",
   "services/device-edge-relay/package.json",
+  "services/device-gateway-core",
   "services/device-manager",
   "deployment/device-manager-release-v2.json",
 ];
@@ -62,6 +65,14 @@ try {
     }
     await copySafe(resolve(devicePlaneRoot, entry), join(payload, entry), devicePlaneRoot);
   }
+  await validateDockerCopySources(
+    join(payload, "services/device-control-core/Dockerfile"),
+    payload,
+  );
+  await validateDockerCopySources(
+    join(payload, "services/device-manager/Dockerfile"),
+    join(payload, "services/device-manager"),
+  );
   for (const modulePath of [
     "services/device-control-core/src/sensitive-reference-management.mjs",
     "packages/device-edge-channel-contract/src/index.mjs",
@@ -168,6 +179,40 @@ async function copySafe(source, destination, sourceBoundary) {
   }
 }
 
+async function validateDockerCopySources(dockerfilePath, buildContext) {
+  const dockerfile = await readFile(dockerfilePath, "utf8");
+  for (const [index, rawLine] of dockerfile.split("\n").entries()) {
+    const line = rawLine.trim();
+    if (!/^COPY\s+/i.test(line)) continue;
+    if (line.endsWith("\\") || /^COPY\s+\[/i.test(line)) {
+      throw new Error(`unsupported_docker_copy_syntax:${dockerfilePath}:${index + 1}`);
+    }
+    const tokens = line.split(/\s+/).slice(1);
+    while (tokens[0]?.startsWith("--")) tokens.shift();
+    if (tokens.length < 2) {
+      throw new Error(`invalid_docker_copy:${dockerfilePath}:${index + 1}`);
+    }
+    for (const source of tokens.slice(0, -1)) {
+      if (/[*?[\]{}]/.test(source)) {
+        throw new Error(`docker_copy_glob_rejected:${dockerfilePath}:${index + 1}:${source}`);
+      }
+      const resolvedSource = resolve(buildContext, source);
+      const relativeSource = relative(buildContext, resolvedSource);
+      if (!relativeSource || relativeSource.startsWith("..") || resolve(buildContext, relativeSource) !== resolvedSource) {
+        throw new Error(`docker_copy_source_outside_context:${dockerfilePath}:${index + 1}:${source}`);
+      }
+      try {
+        await lstat(resolvedSource);
+      } catch (error) {
+        if (error?.code === "ENOENT") {
+          throw new Error(`docker_copy_source_missing:${dockerfilePath}:${index + 1}:${source}`);
+        }
+        throw error;
+      }
+    }
+  }
+}
+
 function canonicalTarScript() {
   return [
     "import gzip,io,pathlib,sys,tarfile",