fix(libraryagent): 把宿主侧对象存储端点纳入固定命令形态

上一提交只给 libraryctl 加了 -source-s3-endpoint，agent 却不知道这个 flag，
systemd 起不来（exit 2）。端点属于"这台主机怎么访问这个源的存储"，必须由 agent
自己钉住并随固定声明传给 libraryctl；请求仍然不能改。没配置时不凭空加 flag。

试过：make verify 15 项全绿；新增 agent 声明用例（有端点必传、无端点不多传）。

cmd/libraryagent/main.go

@@ -27,6 +27,7 @@ func main() {
 	flag.StringVar(&config.SourceApp, "source-app", "WKNFull-app", "source container describing the stack")
 	flag.StringVar(&config.SourcePG, "source-pg", "WKNFull-postgres", "source PostgreSQL container")
 	flag.StringVar(&config.SourceES, "source-es", "WKNFull-elasticsearch", "source Elasticsearch container")
+	flag.StringVar(&config.SourceS3Endpoint, "source-s3-endpoint", "", "host-reachable source object-store endpoint (overrides the container-internal one)")
 	flag.StringVar(&config.GovernancePG, "governance-pg", "knowledge-governance-p1-postgres-1", "governance PostgreSQL container")
 	flag.StringVar(&config.Project, "project", "weknora071full", "Compose project owning the writers")
 	flag.StringVar(&config.Writers, "writers", "app", "declared writer services")

internal/libraryagent/agent.go

@@ -40,6 +40,9 @@ type Config struct {
 	SourceApp    string
 	SourcePG     string
 	SourceES     string
+	// SourceS3Endpoint 让宿主机用可达地址读源对象存储：容器 env 里的端点常常
+	// 只是服务名（minio:9000），宿主机解析不到，资源导出会失败。
+	SourceS3Endpoint string
 	GovernancePG string
 	Project      string
 	Writers      string
@@ -268,17 +271,22 @@ func (a *Agent) recoverWriters(ctx context.Context) error {
 // declaration pins every path and the writer group so a request cannot redirect
 // the operation to another stack, archive or journal.
 func (c Config) declaration() []string {
-	return []string{
+	args := []string{
 		"-source-app", c.SourceApp,
 		"-source-pg", c.SourcePG,
 		"-source-es", c.SourceES,
+	}
+	if c.SourceS3Endpoint != "" {
+		args = append(args, "-source-s3-endpoint", c.SourceS3Endpoint)
+	}
+	return append(args,
 		"-governance-pg", c.GovernancePG,
 		"-project", c.Project,
 		"-writers", c.Writers,
 		"-non-writers", c.NonWriters,
 		"-archive", c.ArchiveRoot,
 		"-journal", c.JournalRoot,
-	}
+	)
 }
 
 func (c Config) run(ctx context.Context, name string, args ...string) ([]byte, error) {

internal/libraryagent/agent_test.go

@@ -336,3 +336,47 @@ func TestNewRejectsIncompleteConfiguration(t *testing.T) {
 		t.Fatal("non-writer declaration without a reason accepted")
 	}
 }
+
+// 宿主机可达的源对象存储端点必须由 agent 自己钉住：请求不能改，也不能被悄悄丢掉
+// （掉了就会退回"容器里那个解析不到的服务名"，真实封存报 read library resource）。
+func TestAgentPinsTheHostSideObjectEndpoint(t *testing.T) {
+	config := Config{
+		Socket:           "/tmp/agent.sock",
+		Binary:           "/bin/echo",
+		ArchiveRoot:      "/tmp/library",
+		JournalRoot:      "/tmp/freeze",
+		SourceApp:        "app-container",
+		SourcePG:         "pg",
+		SourceES:         "es",
+		SourceS3Endpoint: "http://127.0.0.1:19100",
+		GovernancePG:     "gov",
+		Project:          "proj",
+		Writers:          "app",
+		NonWriters:       "postgres=database store",
+		MaxDuration:      time.Minute,
+	}
+	agent, err := New(config)
+	if err != nil {
+		t.Fatalf("new: %v", err)
+	}
+	args := agent.config.declaration()
+	found := false
+	for i := 0; i+1 < len(args); i++ {
+		if args[i] == "-source-s3-endpoint" && args[i+1] == "http://127.0.0.1:19100" {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("声明里没有宿主侧对象存储端点：%v", args)
+	}
+	config.SourceS3Endpoint = ""
+	bare, err := New(config)
+	if err != nil {
+		t.Fatalf("new without endpoint: %v", err)
+	}
+	for _, arg := range bare.config.declaration() {
+		if arg == "-source-s3-endpoint" {
+			t.Fatal("没有端点时不该凭空多一个 flag")
+		}
+	}
+}