Add Aliyun managed provider support

[dragonforce2010]

Summary

• add Aliyun FC deployment helper for managed runtime and sandbox use cases
• wire Aliyun FC runtime/sandbox provisioning into workspace pools with primary/standby fallback support
• harden stable veFaaS deployment adoption/rotation so cloud e2e can roll forward without losing env/VPC config
• add Aliyun FC deploy contract coverage and include it in contract suites

Verification

• bun run test:aliyun-fc-deploy
• env MAPLE_MYSQL_PORT=3307 MAPLE_MYSQL_PASSWORD=maple MAPLE_MYSQL_DATABASE=maple MAPLE_MYSQL_USER=root bun run test:aliyun-provider-orchestration
• bun run typecheck
• bun run lint
• bun run build
• env MAPLE_MYSQL_PORT=3307 MAPLE_MYSQL_PASSWORD=maple MAPLE_MYSQL_DATABASE=maple MAPLE_MYSQL_USER=root MAPLE_MYSQL_HELPER_TIMEOUT_MS=30000 MAPLE_LOCAL_DOCKER_MODE=false MAPLE_SEED_DEFAULT_MODELS=true bun run ci:contracts
• env MAPLE_MYSQL_PORT=3307 MAPLE_MYSQL_PASSWORD=maple MAPLE_MYSQL_DATABASE=maple MAPLE_MYSQL_USER=root MAPLE_MYSQL_HELPER_TIMEOUT_MS=30000 MAPLE_LOCAL_DOCKER_MODE=true MAPLE_SEED_DEFAULT_MODELS=true bun run test:e2e:local-docker
• real Aliyun FC smoke: created maple-codex-fc-20260623-0414, wrote/listed qa/aliyun-fc-smoke.txt, then deleted trigger/function
• real Aliyun OSS smoke: created maple-codex-oss-20260623-0414-zzeh6o, put/get/signed URL, then deleted object/bucket
• cloud stable deploy: https://sd8t0ln1jtbcjjsjsmb80.apigateway-cn-beijing.volceapi.com on frontend 1ghkx9ys and backend ng8ojpgo
• cloud min story e2e: workspace ws_edrisR0zRN, session sess_MaI2jbcEyB, SDK/curl write/list tool calls completed

Cleanup

• Aliyun FC trigger/function deleted after smoke
• Aliyun OSS object/bucket deleted after smoke
• cloud e2e runtime function uzzl1w6c route/upstream/function deleted
• unused replacement functions s4r3xmlz, 32ct74me, fgclrbz0, 2up3ed46, 0y26xymi, zmmi0fbd deleted

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dd6f2b5a5d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Allow managed Aliyun sandboxes past validation

With this default deploy script, an Aliyun FC sandbox no longer needs a pre-existing invoke_url, but the workspace creation path still rejects any Aliyun sandbox/pool that lacks ALIYUN_FC_INVOKE_URL in missingWorkspaceProvisioningCredentials (apps/control-plane-api/src/routes/workspaceRoutes.ts:286-292). In the normal API/UI onboarding flow with only Aliyun credentials, this new branch is never reached, so managed sandbox deployment cannot be used unless users manually edit the workspace config or pre-create a function URL.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Honor Aliyun pool instance caps

Runtime pool provisioning now passes MAPLE_RUNTIME_FUNCTION_MAX_INSTANCES into the default Aliyun deploy script, but resolveDeployConfig only consumes MAPLE_RUNTIME_FUNCTION_MAX_CONCURRENCY (per-instance concurrency) and MAPLE_ALIYUN_FC_RESERVED_CONCURRENCY. For a workspace pool configured with max_instances_per_function: 1, the default script creates an uncapped FC function, so the pool's scaling/cost cap is silently ignored.

Useful? React with 👍 / 👎.