收紧移动壳相机权限来源门禁

禁止 Android 源 app.json 手写 CAMERA 权限

要求 CAMERA 只由真实扫码和拍摄插件生成到最终 Expo 配置

同步移动壳权限来源决策记录

apps/mobile-shell/scripts/check-config.mjs

@@ -955,6 +955,9 @@ if (
 ) {
   throw new Error('mobile shell Android package must request only RECORD_AUDIO for same-origin H5 microphone gameplay');
 }
+if (appConfig.android?.permissions?.includes('android.permission.CAMERA')) {
+  throw new Error('mobile shell Android CAMERA permission must come from real camera plugins only');
+}
 
 for (const permission of blockedAndroidPermissions) {
   if (!appConfig.android?.blockedPermissions?.includes(permission)) {

apps/mobile-shell/scripts/check-expo-config.mjs

@@ -212,6 +212,9 @@ assertSameSet(
   ['android.permission.CAMERA', 'android.permission.RECORD_AUDIO'],
   'Android explicit permissions',
 );
+if (appConfig.android?.permissions?.includes('android.permission.CAMERA')) {
+  throw new Error('Expo source config must not hard-code Android CAMERA permission');
+}
 assertIncludes(
   expoConfig.android?.blockedPermissions,
   'android.permission.MANAGE_EXTERNAL_STORAGE',