门禁加固与 Windows 可跑性

- 新增 scripts/check-generated-bindings.mjs 并接入 lint 与 ai-game-creator-shell:check:rust:crates：重跑 export_bindings 前后逐字节比对共享契约绑定。
- check:native-shells 的 AGC 边界改为负向门禁：渲染源码不得出现 fetch(/XHR/EventSource/sendBeacon/WebSocket/plugin-http，客户端 capability 不得授予 http:default。
- check-pingora-gateway-smoke 在 Windows 上找 pingora-gateway.exe，并修掉「API 并发保护」先关客户端连接再读响应的竞态。
- mobile-shell 三个 smoke 改成固定命令串启动 npm（绕开 npm.cmd EINVAL 与 DEP0190），desktop-shell 的 stage-release-binary 改用 fileURLToPath 修掉 F:\F:\… 路径拼接。
- vitest.config.ts 白名单补回现役根用例；三份 nginx 模板的 SPA allowlist 补回 /components 与 /design-system。

deploy/container/nginx.conf

@@ -141,7 +141,7 @@ http {
             try_files /index.html =404;
         }
 
-        location ~* "^/(?:creation|editor/canvas|profile|project)/?$" {
+        location ~* "^/(?:components|creation|design-system|editor/canvas|profile|project)/?$" {
             try_files $uri /index.html =404;
         }
         # END GENARRATIVE MAIN SPA ROUTES

deploy/nginx/genarrative-dev-http.conf

@@ -190,7 +190,7 @@ server {
         try_files /index.html =404;
     }
 
-    location ~* "^/(?:creation|editor/canvas|profile|project)/?$" {
+    location ~* "^/(?:components|creation|design-system|editor/canvas|profile|project)/?$" {
         error_page 503 /maintenance.html;
 
         if ($genarrative_maintenance) {

deploy/nginx/genarrative.conf

@@ -210,7 +210,7 @@ server {
         try_files /index.html =404;
     }
 
-    location ~* "^/(?:creation|editor/canvas|profile|project)/?$" {
+    location ~* "^/(?:components|creation|design-system|editor/canvas|profile|project)/?$" {
         error_page 503 /maintenance.html;
 
         if ($genarrative_maintenance) {