fix(deploy): heicode-test 上云修复 — ACR 名/Redis 明文/plan token/聚合阈值/git grant

- launcher 透传 AGENT_PLAN_MAX_TOKENS 给 agent pod(避网关 >32768 → 400 断 fan-out)
- manifest: ACR heicodeest→heicodetest、AGGREGATE_ACCEPTANCE_THRESHOLD=70、
  HEICODE_SECRET_swe_git_1 走 secretKeyRef(SWE-bench clone 凭据)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k8s/orchestrator-heicode-test.yaml

@@ -50,7 +50,7 @@ spec:
       # imagePullSecrets: [{ name: acr-pull }]
       containers:
         - name: orchestrator
-          image: heicodeest.azurecr.io/swarm-orchestrator:heicode-test   # ← 填 ACR
+          image: heicodetest.azurecr.io/swarm-orchestrator:heicode-test   # ← 填 ACR
           imagePullPolicy: Always
           ports:
             - containerPort: 8000
@@ -69,7 +69,7 @@ spec:
             - name: AGENT_LAUNCH_BACKEND
               value: "kubernetes"
             - name: AGENT_POD_IMAGE
-              value: "heicodeest.azurecr.io/swarm-agent:heicode-test"     # ← 填 ACR
+              value: "heicodetest.azurecr.io/swarm-agent:heicode-test"     # ← 填 ACR
             - name: AGENT_POD_NAMESPACE
               value: "swarm-system"
             - name: ORCHESTRATOR_PUBLIC_URL
@@ -97,6 +97,17 @@ spec:
               value: "64"
             - name: AGENT_PROPOSAL_BUDGET
               value: "12"
+            # plan/分解 token 上限：降到 32768 避开模型网关 >32768 → 400(launcher 透传给 agent pod)
+            - name: AGENT_PLAN_MAX_TOKENS
+              value: "32768"
+            # 协作聚合质量门：pass_rate<70 打回迭代（对齐本地已验证收敛行为；未设=门关=不打回）
+            - name: AGGREGATE_ACCEPTANCE_THRESHOLD
+              value: "70"
+            # SWE-bench repo clone 凭据（dev secret 解析：grant.secret_ref 末段 swe_git_1 → 读此 env）
+            # JSON {"git_username":...,"git_password":...}，走 Secret，绝不明文。
+            - name: HEICODE_SECRET_swe_git_1
+              valueFrom:
+                secretKeyRef: { name: swarm-git-grant, key: HEICODE_SECRET_swe_git_1 }
             # --- 隔离沙箱双门控（heicode-test 已确认隔离集群）---
             - name: ENABLE_QUALITY_EVAL
               value: "1"

orchestrator/agent_launcher.py

@@ -496,6 +496,11 @@ def plan_launch_specs(
         # launched agents decompose + hand off subtasks to peers (else each agent does its task alone).
         if os.getenv("ENABLE_SUBTASK_HANDOFF", "false").lower() in {"1", "true", "yes"}:
             env["ENABLE_SUBTASK_HANDOFF"] = "true"
+        # 透传 plan/分解 token 上限到 agent pod：部分模型网关上限 32768，>之 400 → 分解调用失败、
+        # fan-out 断。deployment 设 AGENT_PLAN_MAX_TOKENS 时透传；未设则不传，agent 用自身默认。
+        plan_max_tokens = os.getenv("AGENT_PLAN_MAX_TOKENS")
+        if plan_max_tokens:
+            env["AGENT_PLAN_MAX_TOKENS"] = plan_max_tokens
         specs.append(AgentLaunchSpec(agent_id=env["AGENT_ID"], capabilities=cap_csv, env=env))
     return specs