收口移动壳H5入口来源

移动壳启动URL仅允许生产主站和本机开发入口

补充移动壳URL和deep link测试，防止外域H5获得HostBridge

更新原生壳方案和共享决策记录

apps/mobile-shell/scripts/check-config.mjs

@@ -525,6 +525,19 @@ if (
   throw new Error('mobile shell default H5 URL must point to the production web app');
 }
 
+for (const snippet of [
+  "ALLOWED_PRODUCTION_WEB_ORIGIN = 'https://app.genarrative.world'",
+  'LOCAL_DEVELOPMENT_WEB_HOSTS',
+  "'127.0.0.1'",
+  "'localhost'",
+  "'[::1]'",
+  'isAllowedMobileShellBaseUrl',
+]) {
+  if (!mobileShellUrlSource.includes(snippet)) {
+    throw new Error(`mobile shell H5 URL allowlist missing ${snippet}`);
+  }
+}
+
 if (appSource.includes('127.0.0.1:3000')) {
   throw new Error('mobile shell App must not hard-code localhost as the default H5 URL');
 }