chore: 初始开源发布

iotlcm-worker-svr：异步执行中枢（RabbitMQ 消费者 + 全量同步编排）。

- Go module：iotlcm-worker-svr → git.5iot.com/iotlcm-public/iotlcm-worker-svr（214 文件）
- 凭据与内部标识脱敏：MySQL/Redis 凭据、私网与生产 IP、内网域名、
  库名 xiujie_admin → iotlcm、哨兵名占位
- 159 处真实手机号 → 合法 11 位编造号（保留号段与后 4 位，维持互异，
  不破坏「校验 MSISDN 格式」等测试断言）
- 移除内部资产：CI 触发器、Jenkins 触发测试文档、预演门禁与镜像
  digest 记录
- Dockerfile 改用公共基础镜像（golang:1.25-alpine → alpine:3.23），
  移除写死的 git 凭据
- README 重写（架构/全量同步模型/配置/已知失败），补 Apache-2.0
  LICENSE，LF 行尾 + .gitattributes

已知：3 个测试包在源仓同一提交上同样失败（client/upstream、
service/allocate、service/inbound），属既有缺陷，本仓未引入亦未修复。

internal/model/sync_scope.go

@@ -0,0 +1,149 @@
+package model
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+)
+
+// SyncScope narrows one full-sync run to an explicit channel whitelist.
+//
+// A nil scope, or one whose channel list normalizes to empty, means "full
+// sync" and must behave exactly like a run started before this field existed.
+// TriggerSource is descriptive only: it is recorded on the run for operators
+// and never changes scheduling or retry behaviour.
+type SyncScope struct {
+	Channels      []string `json:"channels,omitempty"`
+	TriggerSource string   `json:"triggerSource,omitempty"`
+}
+
+const (
+	// MaxScopeChannels bounds one partial-sync request. It is a guard against
+	// accidental "select everything" payloads, not a capacity limit.
+	MaxScopeChannels = 200
+	// MaxChanKeyLength matches t_sim_channels.chan_key varchar(32).
+	MaxChanKeyLength = 32
+)
+
+// Trigger source values recorded on the run.
+const (
+	TriggerSourceScheduled = "scheduled"
+	TriggerSourceManual    = "manual"
+	TriggerSourceAPI       = "api"
+	TriggerSourceReplay    = "replay"
+)
+
+// NormalizeScope validates a requested scope and returns its canonical form.
+//
+// Canonical form is: nil for a full sync, otherwise a scope whose channel list
+// is deduplicated and sorted. Sorting makes ScopeDigest stable across requests
+// that select the same channels in a different order.
+func NormalizeScope(scope *SyncScope) (*SyncScope, error) {
+	if scope == nil {
+		return nil, nil
+	}
+	triggerSource := strings.TrimSpace(scope.TriggerSource)
+	switch triggerSource {
+	case "", TriggerSourceScheduled, TriggerSourceManual, TriggerSourceAPI, TriggerSourceReplay:
+	default:
+		return nil, fmt.Errorf("invalid triggerSource %q", scope.TriggerSource)
+	}
+	if len(scope.Channels) == 0 {
+		return nil, nil
+	}
+	if len(scope.Channels) > MaxScopeChannels {
+		return nil, fmt.Errorf("scope has %d channels, maximum is %d", len(scope.Channels), MaxScopeChannels)
+	}
+
+	seen := make(map[string]struct{}, len(scope.Channels))
+	channels := make([]string, 0, len(scope.Channels))
+	for _, raw := range scope.Channels {
+		chanKey := strings.TrimSpace(raw)
+		if err := ValidateChanKey(chanKey); err != nil {
+			return nil, err
+		}
+		if _, exists := seen[chanKey]; exists {
+			continue
+		}
+		seen[chanKey] = struct{}{}
+		channels = append(channels, chanKey)
+	}
+	if len(channels) == 0 {
+		return nil, nil
+	}
+	sort.Strings(channels)
+
+	if triggerSource == "" {
+		triggerSource = TriggerSourceManual
+	}
+	return &SyncScope{Channels: channels, TriggerSource: triggerSource}, nil
+}
+
+// ValidateChanKey rejects values that cannot exist in t_sim_channels.chan_key.
+// The whitelist character set keeps the value safe to log and to embed in a
+// Redis key without escaping.
+func ValidateChanKey(chanKey string) error {
+	if chanKey == "" {
+		return fmt.Errorf("chanKey is empty")
+	}
+	if len(chanKey) > MaxChanKeyLength {
+		return fmt.Errorf("chanKey %q exceeds %d characters", chanKey, MaxChanKeyLength)
+	}
+	for _, r := range chanKey {
+		switch {
+		case r >= 'a' && r <= 'z':
+		case r >= 'A' && r <= 'Z':
+		case r >= '0' && r <= '9':
+		case r == '-' || r == '_':
+		default:
+			return fmt.Errorf("chanKey %q contains invalid character %q", chanKey, r)
+		}
+	}
+	return nil
+}
+
+// ChannelSet returns the scope channels as a lookup set, or nil for a full
+// sync. Callers treat nil as "no filtering".
+func (s *SyncScope) ChannelSet() map[string]struct{} {
+	if s == nil || len(s.Channels) == 0 {
+		return nil
+	}
+	set := make(map[string]struct{}, len(s.Channels))
+	for _, chanKey := range s.Channels {
+		set[chanKey] = struct{}{}
+	}
+	return set
+}
+
+// Allows reports whether a card on chanKey belongs to this scope. A nil scope
+// allows every channel.
+func (s *SyncScope) Allows(chanKey string) bool {
+	if s == nil || len(s.Channels) == 0 {
+		return true
+	}
+	for _, allowed := range s.Channels {
+		if allowed == chanKey {
+			return true
+		}
+	}
+	return false
+}
+
+// ChannelCount is the number of selected channels; zero means full sync.
+func (s *SyncScope) ChannelCount() int {
+	if s == nil {
+		return 0
+	}
+	return len(s.Channels)
+}
+
+// ChannelSample returns at most limit channels for logging and run metadata.
+func (s *SyncScope) ChannelSample(limit int) []string {
+	if s == nil || limit <= 0 {
+		return nil
+	}
+	if len(s.Channels) <= limit {
+		return s.Channels
+	}
+	return s.Channels[:limit]
+}