ci: check readiness and the release version after deploy

The ops port serves GET /version, so the smoke test can confirm that the
upgraded build is the one answering.

.github/workflows/cd.yml

@@ -62,19 +62,30 @@ jobs:
           HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
         run: |
           set -euo pipefail
-          kubectl port-forward --namespace alisten service/alisten-serve 18090:9090 &
+
+          kubectl port-forward \
+            --namespace alisten \
+            --address 127.0.0.1 \
+            service/alisten-serve 18090:9090 &
           pid=$!
           trap 'kill "$pid" 2>/dev/null || true' EXIT
+
+          base_url="http://127.0.0.1:18090"
+
           curl --silent --show-error --fail \
-            --retry 10 \
-            --retry-delay 2 \
+            --connect-timeout 2 \
+            --max-time 5 \
+            --retry 20 \
+            --retry-delay 1 \
             --retry-connrefused \
-            --max-time 10 \
-            http://127.0.0.1:18090/readyz
-          # CI 构建发布镜像时把 tag+commit 写进版本号。
+            --retry-max-time 60 \
+            "${base_url}/readyz"
+
           expected="${TAG}+${HEAD_SHA}"
-          actual="$(curl --silent --show-error --fail --max-time 10 http://127.0.0.1:18090/version)"
-          if [[ "$actual" != "$expected" ]]; then
-            printf '线上版本是 %s，期望 %s\n' "$actual" "$expected" >&2
-            exit 1
-          fi
+          actual="$(curl --silent --show-error --fail \
+            --connect-timeout 2 \
+            --max-time 5 \
+            "${base_url}/version")"
+
+          diff -u --label expected --label actual \
+            <(echo "$expected") <(echo "$actual")