补充上游元数据漂移的拒绝用例

- 准备步骤用例新增一条：上游 codex-package.json 的 version/layoutVersion/entrypoint/resourcesDir 任一与声明不一致时必须拒绝且不落产物（共 10 条）
- 同步决策日志与 M2 里程碑规范里的用例计数

apps/ai-game-creator-shell/scripts/prepare-bundled-resources.test.mjs

@@ -312,6 +312,49 @@ test('copies only whitelisted plugin subdirectories', () => {
   }
 });
 
+test('fails closed when the upstream package metadata drifts from the declaration', () => {
+  const fixture = buildFixture();
+  try {
+    const declaration = fixture.declaration;
+    const layout = declaration.codex.targets.find(
+      (entry) => entry.target === WINDOWS_TARGET,
+    );
+    const metadataFile = path.join(
+      fixture.appRoot,
+      `node_modules/@openai/codex-${layout.platform}/vendor/${WINDOWS_TARGET}/codex-package.json`,
+    );
+    const metadata = JSON.parse(fs.readFileSync(metadataFile, 'utf8'));
+    assert.equal(metadata.version, declaration.codex.version);
+    for (const [key, value] of [
+      ['version', '0.0.0'],
+      ['layoutVersion', 2],
+      ['entrypoint', 'bin/other.exe'],
+      ['resourcesDir', '../private'],
+    ]) {
+      fs.writeFileSync(
+        metadataFile,
+        `${JSON.stringify({ ...metadata, [key]: value }, null, 2)}\n`,
+      );
+      assert.throws(
+        () => prepare(fixture),
+        /上游包元数据与声明不一致/,
+        `${key} 漂移必须被拒绝`,
+      );
+    }
+    assert.ok(
+      !fs.existsSync(
+        path.join(
+          fixture.destinationRoot,
+          'resources/codex/win-x64/manifest.json',
+        ),
+      ),
+      '拒绝时不得留下产物',
+    );
+  } finally {
+    fixture.cleanup();
+  }
+});
+
 test('fails closed when the upstream package is missing', () => {
   const fixture = buildFixture();
   try {