ci(vps-gate): commit必打[vps]/[nas]标签+vps-deployed tag+待推issue [nas]

- ci-cd: enforce-label(本次push无标签→fail,merge豁免) + check-vps-needed(nas-verify绿后对比vps-deployed tag,有[vps]未部署→开issue)
- vps-deploy: 成功打vps-deployed tag + 关issue(gap清空)
- scripts/ci/vps_pending_check.py: issue开/关/更新(CI复用)
- docs: vps-impact-map触及面表 + vps-deploy-pending判定记录
- CLAUDE.md: 部署流程段补标签约定

.gitea/workflows/vps-deploy.yml

@@ -40,3 +40,18 @@ jobs:
         run: bash scripts/nas_sync/promote.sh --target vps
       - name: VPS 冒烟 (LocalUnifiedProvider 真数据)
         run: ssh 49.232.102.198 'cd C:\sanguo_vnpy_v2 && C:\Python310\python.exe -X utf8 scripts/data_platform/verify_unified_e2e.py'
+      - name: mark vps-deployed tag (VPS 版本真相, session 用 git log vps-deployed..HEAD 查未部署)
+        env:
+          TOKEN: ${{ github.token }}
+        run: |
+          set -e
+          SHA="${{ inputs.sha }}"
+          git tag -f vps-deployed "$SHA"
+          git push -f "http://oauth2:${TOKEN}@192.168.2.154:3000/${GITHUB_REPOSITORY}.git" refs/tags/vps-deployed
+          echo "✅ vps-deployed → ${SHA::7}"
+      - name: 关闭 [待推VPS] issue (tag=HEAD → gap 清空 = 绿)
+        env:
+          GTOKEN: ${{ github.token }}
+        run: |
+          export VPS_LOG=""
+          python3 scripts/ci/vps_pending_check.py