修复Jenkins Web依赖安装

Web构建同时安装根目录与AGC独立lockfile依赖
Full流水线同步RUN_NPM_CI参数说明
生产运维门禁锁定双依赖安装顺序
运维文档补充故障原因与依赖边界

scripts/check-production-ops-guardrails.mjs

@@ -7376,6 +7376,38 @@ if ((fullPipelineMaintenanceHoldCalls?.length ?? 0) !== 2) {
   );
 }
 
+const webBuildContent = readFileSync(
+  'jenkins/Jenkinsfile.production-web-build',
+  'utf8',
+);
+const webBuildStageOffset = webBuildContent.indexOf("stage('Build Web')");
+const webArchiveStageOffset = webBuildContent.indexOf(
+  "stage('Archive')",
+  webBuildStageOffset,
+);
+const webBuildStageContent =
+  webBuildStageOffset >= 0 && webArchiveStageOffset > webBuildStageOffset
+    ? webBuildContent.slice(webBuildStageOffset, webArchiveStageOffset)
+    : '';
+const webNpmCiBlock = `if (params.RUN_NPM_CI) {
+            sh 'bash -lc "npm ci"'
+            sh 'bash -lc "npm ci --prefix apps/ai-game-creator-shell"'
+          }`;
+const webNpmCiBlockOffset = webBuildStageContent.indexOf(webNpmCiBlock);
+const webTestOffset = webBuildStageContent.indexOf('npm run test');
+const webNpmCiCalls = webBuildStageContent.match(/\bnpm ci(?:\s|["'])/gu);
+if (
+  webNpmCiBlockOffset < 0 ||
+  webTestOffset < 0 ||
+  webNpmCiBlockOffset >= webTestOffset ||
+  (webNpmCiCalls?.length ?? 0) !== 2
+) {
+  failed = true;
+  console.error(
+    '[check:production-ops] Web Build 必须在 RUN_NPM_CI 条件块内依次安装根 lockfile 与 apps/ai-game-creator-shell 独立 lockfile，并在 npm run test 前完成；RUN_NPM_CI=false 时两次安装必须一起跳过。',
+  );
+}
+
 const exitMaintenanceStageOffset = fullPipelineContent.indexOf(
   "stage('Exit Maintenance')",
 );