fix(deploy): review fixes — smoke photoId field, web healthcheck wget, outbox table name, cdn key shape

Reviewer findings on p5-prep batch:
1. BLOCKING: prod-smoke.sh visibility grep used "id" but API items
   serialize photoId (cn public.service / ov public-ov.service) — every
   healthy deployment would false-FAIL release gate ④. 4 sites fixed.
2. web/web-ov healthchecks used curl on nginx:alpine (absent) → perpetual
   false-unhealthy; switched to busybox wget.
3. RUNBOOK rollback rule cited nonexistent sync_outbox → outbox_events.
4. cdn-checklist invalidation sample key shape aligned to actual
   variantsObjectKey layout (.../albums/{albumId}/variants/{photoId}/{version}/{variant}.jpg).

Co-Authored-By: Claude Code <noreply@anthropic.com>

infra/deploy/RUNBOOK.md

@@ -93,7 +93,7 @@
    ```
 
 3. **数据与同步状态保留原则**（硬性）：
-   - 不清 `sync_outbox` / `sync_inbox` / `sync_state` / `outbox_stat_events`；
+   - 不清 `outbox_events` / `sync_inbox` / `sync_state` / `outbox_stat_events`；
      未确认事件在新一轮推送中按 eventId 幂等重放，水位断层才需要人工补漏
      （对账循环 5min 自动按水位拉 reconcile，无需干预）。
    - 不 `migrate resolve`/手工改 `_prisma_migrations`；异常迁移记录单独记录并

infra/deploy/cdn-checklist.md

@@ -95,8 +95,8 @@
 # 多 URL 用换行分隔（RefreshObjectCatches/PreloadObjectCaches 的 ObjectPath 约定）
 aliyun cdn RefreshObjectCaches \
   --ObjectPath "$(printf '%s\n%s' \
-    'https://<图片域名>/variants/thumb/<photoId>/<版本>.webp' \
-    'https://<图片域名>/variants/browse/<photoId>/<版本>.webp')" \
+    'https://<图片域名>/photo-live/prod/albums/<albumId>/variants/<photoId>/<version>/thumb.jpg' \
+    'https://<图片域名>/photo-live/prod/albums/<albumId>/variants/<photoId>/<version>/browse.jpg')" \
   --ObjectType File
 
 # 新活动发布 → 预热首页与首屏静态资源（viewer 域名，降低冷缓存首访时延）

infra/deploy/docker-compose-ov.yml

@@ -43,7 +43,7 @@ services:
     depends_on:
       api-ov: { condition: service_healthy }
     healthcheck:
-      test: ["CMD", "curl", "-fs", "http://127.0.0.1/"]
+      test: ["CMD", "wget", "-qO", "/dev/null", "http://127.0.0.1/"]
       interval: 30s
       timeout: 5s
       retries: 5

infra/deploy/docker-compose.cn.yml

@@ -72,7 +72,7 @@ services:
     depends_on:
       api-cn: { condition: service_healthy }
     healthcheck:
-      test: ["CMD", "curl", "-fs", "http://127.0.0.1/"]
+      test: ["CMD", "wget", "-qO", "/dev/null", "http://127.0.0.1/"]
       interval: 30s
       timeout: 5s
       retries: 5