锁定移动壳WebView来源白名单

补充移动壳 WebView originWhitelist 仅允许当前 H5 origin 的测试

扩展移动壳配置门禁防止来源白名单被放宽

apps/mobile-shell/scripts/check-config.mjs

@@ -1503,6 +1503,7 @@ for (const snippet of [
   'SafeAreaView',
   'MOBILE_SHELL_SAFE_AREA_EDGES',
   'resolveMobileShellBaseWebUrl',
+  'originWhitelist={[allowedWebOrigin]}',
   'javaScriptCanOpenWindowsAutomatically={false}',
   'mixedContentMode="never"',
   'allowFileAccess={false}',
@@ -1537,6 +1538,10 @@ if (!shellAppTestSource.includes('blocked WebView file downloads are logged for
   throw new Error('mobile shell tests must cover blocked WebView file download diagnostics');
 }
 
+if (!shellAppTestSource.includes('WebView origin whitelist is limited to the resolved H5 origin')) {
+  throw new Error('mobile shell tests must cover WebView origin whitelist boundaries');
+}
+
 for (const snippet of [
   "describe('mobile shell safe area'",
   "test('protects the WebView from every device edge'",