feat: add guarded portal canary release

scripts/release-portal-runtime-prod.sh

@@ -84,8 +84,9 @@ if [[ "${ALLOW_MINDSPACE_PUBLIC_LINK_ISSUES:-0}" == "1" ]]; then
 fi
 
 if [[ "${DRY_RUN}" -eq 0 ]]; then
-  echo "当前脚本执行整包替换，不是用户级灰度入口；在候选 runtime + 灰度代理上线前禁止生产发布。" >&2
-  echo "请先使用 docs/release-canary-103.md 规定的灰度流程，并由守门员重新授权。" >&2
+  echo "当前脚本执行 8081 整包晋升，不是用户级灰度入口。" >&2
+  echo "在同一候选完成 103 灰度验收且晋升证据校验落地前，禁止非 dry-run。" >&2
+  echo "首次生产动作请使用 scripts/release-portal-canary-prod.sh。" >&2
   exit 1
 fi
 
@@ -165,7 +166,7 @@ fi
 
 verify_runtime_artifact() {
   local missing=0
-  for required in server.mjs wechat-mp.bundle.mjs mindspace-sandbox-mcp.mjs tkmind-search-mcp.mjs tkmind-excel-mcp.mjs mindspace-public-links.mjs dist package.json scripts/run-memind-portal-prod.sh scripts/check-mindspace-public-links.mjs scripts/load-env.mjs scripts/wechat-mp-menu.mjs scripts/memind-portal-tunnel.sh; do
+  for required in server.mjs memind-canary-proxy.mjs wechat-mp.bundle.mjs mindspace-sandbox-mcp.mjs tkmind-search-mcp.mjs tkmind-excel-mcp.mjs mindspace-public-links.mjs dist package.json scripts/run-memind-portal-prod.sh scripts/run-memind-portal-candidate.sh scripts/run-memind-canary-proxy-prod.sh scripts/goosed-canary.compose.yml scripts/check-mindspace-public-links.mjs scripts/load-env.mjs scripts/wechat-mp-menu.mjs scripts/memind-portal-tunnel.sh; do
     if [[ ! -e "${RUNTIME_ROOT}/${required}" ]]; then
       echo "runtime 产物缺失: ${RUNTIME_ROOT}/${required}" >&2
       missing=1