fix(gateway): 배포 worktree 자동 정리 추가

Profile과 Gateway release의 현재 실행 및 rollback 경계를 보호하면서 오래된 commit worktree를 주기적으로 정리한다.

app/release-controller/src/index.ts

@@ -7,7 +7,7 @@ import {
 } from '@sammo-ts/gateway-api';
 
 import { resolveReleaseControllerConfig } from './config.js';
-import { GatewayReleaseController } from './releaseController.js';
+import { GatewayReleaseController, RELEASE_WORKSPACE_CLEANUP_INTERVAL_MS } from './releaseController.js';
 import { upgradeReleaseController } from './selfUpgrade.js';
 
 export * from './config.js';
@@ -67,6 +67,7 @@ const main = async (): Promise<void> => {
     }
     if (command !== 'daemon') throw new Error(`Unknown release-controller command: ${command}`);
     let stopping = false;
+    let nextWorkspaceCleanupAt = 0;
     const stop = async (): Promise<void> => {
         if (stopping) return;
         stopping = true;
@@ -75,6 +76,18 @@ const main = async (): Promise<void> => {
     process.once('SIGINT', () => void stop());
     process.once('SIGTERM', () => void stop());
     while (!stopping) {
+        const now = Date.now();
+        if (now >= nextWorkspaceCleanupAt) {
+            nextWorkspaceCleanupAt = now + RELEASE_WORKSPACE_CLEANUP_INTERVAL_MS;
+            try {
+                const result = await controller.cleanupStaleWorkspaces();
+                if (result.removed.length > 0) {
+                    console.info(`[release-controller] removed ${result.removed.length} stale Gateway worktrees`);
+                }
+            } catch (error) {
+                console.error('[release-controller] workspace cleanup failed', error);
+            }
+        }
         await controller.runOnce();
         await new Promise<void>((resolve) => setTimeout(resolve, config.pollIntervalMs));
     }

app/release-controller/src/releaseController.ts

@@ -6,6 +6,8 @@ import {
     assertReleaseComponents,
     buildTurboReleaseCommand,
     buildTurboReleaseTaskCommand,
+    DEFAULT_MANAGED_WORKSPACE_KEEP_NEWEST,
+    DEFAULT_MANAGED_WORKSPACE_RETENTION_MS,
     type BuildCommand,
     type BuildProgressEvent,
     type BuildRunner,
@@ -27,6 +29,16 @@ const HEARTBEAT_INTERVAL_MS = 60_000;
 const CANCELLATION_POLL_INTERVAL_MS = 500;
 const PROCESS_NAMES = ['sammo:gateway-api', 'sammo:gateway-frontend', 'sammo:gateway-orchestrator'] as const;
 const SENSITIVE_ENV_NAME = /(SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE_KEY|CLIENT_SECRET|DATABASE_URL|REDIS_URL)/iu;
+export const RELEASE_WORKSPACE_CLEANUP_INTERVAL_MS = 24 * 60 * 60 * 1_000;
+
+const isRuntimeProcessActive = (status: string): boolean =>
+    ['online', 'launching', 'stopping'].includes(status.toLowerCase());
+
+const isPathInside = (candidate: string | undefined, root: string): boolean => {
+    if (!candidate) return false;
+    const relative = path.relative(path.resolve(root), path.resolve(candidate));
+    return relative === '' || (!relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+};
 
 const managedPostgresPoolMax = (env: Record<string, string>, roleVariable: string, fallback: number): string =>
     String(resolvePostgresPoolMax(env[roleVariable] ?? env.POSTGRES_POOL_MAX, fallback));
@@ -132,6 +144,33 @@ export class GatewayReleaseController {
         private readonly fetchImpl: typeof fetch = fetch
     ) {}
 
+    async cleanupStaleWorkspaces(): Promise<{ removed: string[]; skipped: string[] }> {
+        const [state, processes, workspaces] = await Promise.all([
+            this.repository.getState(),
+            this.processManager.list(),
+            this.workspaceManager.listManagedWorkspaces(),
+        ]);
+        const protectedWorkspaces = new Set<string>();
+        if (state.activeWorkspace) protectedWorkspaces.add(path.resolve(state.activeWorkspace));
+        if (state.previousWorkspace) protectedWorkspaces.add(path.resolve(state.previousWorkspace));
+        const activeProcesses = processes.filter((process) => isRuntimeProcessActive(process.status));
+        for (const workspace of workspaces) {
+            if (
+                activeProcesses.some(
+                    (process) =>
+                        isPathInside(process.cwd, workspace.root) || isPathInside(process.script, workspace.root)
+                )
+            ) {
+                protectedWorkspaces.add(workspace.root);
+            }
+        }
+        return this.workspaceManager.cleanup({
+            protectedPaths: [...protectedWorkspaces],
+            retentionMs: DEFAULT_MANAGED_WORKSPACE_RETENTION_MS,
+            keepNewest: DEFAULT_MANAGED_WORKSPACE_KEEP_NEWEST,
+        });
+    }
+
     private sanitizeLogMessage(message: string): string {
         let sanitized = stripVTControlCharacters(message);
         const sensitiveValues = new Set([