feat: support Baota manual deployment and managed updates

scripts/test-update-fixture.sh

@@ -174,13 +174,20 @@ build_release() {
   local unit_prefix=${3:-new}
   local stage="$fixture/stage"
   mkdir -p "$fixture/release" "$stage/public" "$stage/ops"
+  "$REAL_OPENSSL" genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 \
+    -out "$fixture/private.pem" >/dev/null 2>&1
+  "$REAL_OPENSSL" pkey -in "$fixture/private.pem" -pubout \
+    -out "$fixture/release-public.pem" >/dev/null 2>&1
   printf 'new application\n' > "$stage/app.jar"
   printf '<!doctype html><title>new</title>\n' > "$stage/public/index.html"
   printf '%s\n' "$version" > "$stage/VERSION"
   printf '#!/bin/sh\nprintf "new updater\\n"\n' > "$stage/ops/update.sh"
   printf '#!/usr/bin/env bash\nexit 0\n' > "$stage/ops/baota-start.sh"
+  printf '#!/usr/bin/env bash\nexit 0\n' > "$stage/ops/baota-init.sh"
+  cp "$fixture/release-public.pem" "$stage/ops/release-public.pem"
   chmod 0755 "$stage/ops/update.sh"
   chmod 0755 "$stage/ops/baota-start.sh"
+  chmod 0755 "$stage/ops/baota-init.sh"
   for name in kaidi-finance.service kaidi-update.service kaidi-update.path; do
     printf '%s %s\n' "$unit_prefix" "$name" > "$stage/ops/$name"
   done
@@ -192,10 +199,6 @@ build_release() {
   jq -n --arg version "$version" --arg artifact "$artifact" --arg sha "$sha" \
     '{version:$version,artifact:$artifact,sha256:$sha,publishedAt:"2026-08-16T00:00:00Z",releaseNotes:"fixture"}' \
     > "$fixture/release/release-manifest.json"
-  "$REAL_OPENSSL" genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 \
-    -out "$fixture/private.pem" >/dev/null 2>&1
-  "$REAL_OPENSSL" pkey -in "$fixture/private.pem" -pubout \
-    -out "$fixture/release-public.pem" >/dev/null 2>&1
   "$REAL_OPENSSL" dgst -sha256 -sign "$fixture/private.pem" \
     -out "$fixture/release/release-manifest.sig" "$fixture/release/release-manifest.json"
 }
@@ -284,6 +287,7 @@ run_update() {
     KAIDI_LOG_ROOT="$fixture/log" \
     KAIDI_SYSTEMD_ROOT="$fixture/systemd" \
     KAIDI_UPDATER_PATH="$fixture/app/bin/update.sh" \
+    KAIDI_RUNTIME_ENV_FILE="$fixture/runtime.env" \
     KAIDI_SKIP_DB_BACKUP="$skip_backup" \
     KAIDI_UPDATE_HEALTH_ATTEMPTS=1 \
     KAIDI_UPDATE_HEALTH_INTERVAL_SECONDS=0 \
@@ -424,7 +428,7 @@ assert_rollback_case() {
   if run_update "$fixture" fail-new > "$fixture/update.log" 2>&1; then
     fail 'rollback case unexpectedly succeeded'
   fi
-  grep -q 'previous release was restored and verified' "$fixture/update.log" \
+  grep -q 'previous application release was restored and verified' "$fixture/update.log" \
     || fail 'rollback case did not report a complete restoration'
   [ "$(readlink "$fixture/app/current")" = "$fixture/app/releases/1.0.0-preview.1" ] \
     || fail 'rollback case did not restore the previous application'