收口桌面壳权限文档门禁

修正桌面壳 capability 文档为单一受控权限

原生壳总门禁拒绝方案文档恢复 core 默认权限

同步共享决策记录的 Tauri 权限口径

scripts/check-native-shells.mjs

@@ -333,6 +333,15 @@ function extractDocumentCapabilityList(source, marker) {
 
 function assertNativeShellCapabilityPlan() {
   const planSource = fs.readFileSync(nativeShellPlanPath, 'utf8');
+  if (
+    planSource.includes('permissions` 必须只包含 `core:default`') ||
+    planSource.includes('permissions=["core:default","allow-host-bridge-request"]')
+  ) {
+    throw new Error(
+      'native shell plan must not document core:default as a desktop capability permission',
+    );
+  }
+
   const mobileCapabilitySource = fs.readFileSync(
     'apps/mobile-shell/src/host-bridge/capabilities.ts',
     'utf8',