perf(ci): acquire deploy lock before target agent

scripts/test-environment-pipeline-contract.test.mjs

@@ -49,6 +49,21 @@ test('Java builds use the shared builder pool and serialize incremental target d
   assert.match(directDeployScript, /--pull never/)
 })
 
+test('development and test deployment locks are acquired before target executors', () => {
+  const directDeployStage = pipeline.slice(
+    pipeline.indexOf("stage('部署开发或测试环境')"),
+    pipeline.indexOf("stage('部署单个服务')")
+  )
+  const lockIndex = directDeployStage.indexOf('lock(resource: deployLock')
+  const nodeIndex = directDeployStage.indexOf('node(targetLabel)')
+
+  assert.match(directDeployStage, /agent none/)
+  assert.match(directDeployStage, /String targetLabel = params\.ENVIRONMENT == 'development' \? 'java-dev' : 'java-test'/)
+  assert.ok(lockIndex >= 0, 'deployment lock must exist')
+  assert.ok(nodeIndex >= 0, 'target node allocation must exist')
+  assert.ok(lockIndex < nodeIndex, 'deployment lock must be acquired before target node allocation')
+})
+
 test('parallel remote deployments keep env and compose assets isolated by project', () => {
   assert.match(directDeployScript, /REMOTE_ENV_NAME="\.env\.\$PROJECT_NAME"/)
   assert.match(directDeployScript, /REMOTE_COMPOSE_NAME="docker-compose\.\$PROJECT_NAME\.yml"/)