docs: add note about Vault role prerequisite for CI/CD

README.md

@@ -50,6 +50,12 @@ Only reserve roadmap placeholders for:
 * Active-Active / Active-Passive
 * DR orchestration platform
 
+### ⚠️ CI/CD Prerequisites (Important Notice)
+
+If you are running the GitHub Actions workflow (`deploy-env-migration.yaml`), please ensure that your Vault environment is correctly configured:
+- **Vault Role**: The current configured role is `github-actions-site-recovery` (kept for backward compatibility with the old repository name). Ensure this role exists in your Vault instance.
+- **Role Binding**: If the role is bound to the repository name, make sure the `bound_claims` match or are updated to reflect the new repository name if you ever recreate the role.
+
 ---
 
 # 站点迁移与备份工具集 (Site Migration & Backup Toolkit)
@@ -101,3 +107,9 @@ Only reserve roadmap placeholders for:
 * 数据一致性策略
 * 双活 (Active-Active) / 主备 (Active-Passive)
 * DR 灾备编排平台
+
+### ⚠️ CI/CD 前置条件 (重要提示)
+
+如果您正在运行 GitHub Actions 流水线 (`deploy-env-migration.yaml`)，请确保您的 Vault 环境已正确配置：
+- **Vault 角色 (Role)**: 当前配置的角色名为 `github-actions-site-recovery`（为兼容旧代码库名而保留）。请确保您的 Vault 实例中存在该角色。
+- **角色绑定 (Role Binding)**: 如果该角色是基于代码库名称绑定的，请确保其 `bound_claims` 匹配，或者在重建角色时更新为新的代码库名称。