收口移动壳渠道SDK依赖边界

扩展移动壳配置检查，根包和移动壳包都禁止提前安装移动渠道SDK

更新原生壳方案，说明根依赖不得绕过移动壳发布通道边界

同步共享决策记录，明确真实渠道契约前不接入移动崩溃上报和analytics依赖

apps/mobile-shell/scripts/check-config.mjs

@@ -19,6 +19,8 @@ const sharedContractPath = new URL(
 const sharedContractSource = fs.readFileSync(sharedContractPath, 'utf8');
 const packagePath = new URL('../package.json', import.meta.url);
 const packageConfig = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
+const rootPackagePath = new URL('../../../package.json', import.meta.url);
+const rootPackageConfig = JSON.parse(fs.readFileSync(rootPackagePath, 'utf8'));
 const iconPath = new URL('../assets/icon.png', import.meta.url);
 const icon = PNG.sync.read(fs.readFileSync(iconPath));
 const brandBackgroundColor = '#fffdf9';
@@ -131,7 +133,7 @@ function extractStringConstExport(source, exportName) {
   return match[1];
 }
 
-function assertNoBlockedMobileChannelDependencies() {
+function assertNoBlockedMobileChannelDependencies(packageJson, packageLabel) {
   const dependencySections = [
     'dependencies',
     'devDependencies',
@@ -141,9 +143,9 @@ function assertNoBlockedMobileChannelDependencies() {
 
   for (const dependency of blockedMobileChannelDependencies) {
     for (const section of dependencySections) {
-      if (packageConfig[section]?.[dependency]) {
+      if (packageJson[section]?.[dependency]) {
         throw new Error(
-          `mobile shell must not depend on ${dependency} before the real channel contract exists`,
+          `${packageLabel} must not depend on ${dependency} before the real mobile channel contract exists`,
         );
       }
     }
@@ -250,7 +252,8 @@ function assertSameList(actual, expected, label) {
 assertNoDevScaffoldTerms(
   productionSourceRoots.flatMap((root) => collectProductionSourceFiles(root)),
 );
-assertNoBlockedMobileChannelDependencies();
+assertNoBlockedMobileChannelDependencies(packageConfig, 'mobile shell package');
+assertNoBlockedMobileChannelDependencies(rootPackageConfig, 'root H5 package');
 assertNoBlockedMobileChannelSnippets();
 
 const sharedCapabilities = extractStringArrayExport(