fix(page-data): enforce full workspace bind delivery and repair tooling

Prevent false-positive Finish Guard passes and sync-created fake bindings by assessing publication, policy, dataset, injection, and insert smoke before H5 delivery.

Co-authored-by: Cursor <cursoragent@cursor.com>

page-data-html-detect.mjs

@@ -2,6 +2,18 @@
  * 从 MindSpace 公开 HTML 中解析 Page Data API 引用的 dataset 与读写意图。
  */
 
+const PAGE_DATA_CLIENT_SCRIPT_PATTERN = /\/assets\/page-data-client\.js/i;
+
+export function htmlUsesPageDataApi(html) {
+  const content = String(html ?? '');
+  const usage = detectPageDataDatasetUsageFromHtml(content);
+  return (
+    usage.size > 0 ||
+    PAGE_DATA_CLIENT_SCRIPT_PATTERN.test(content) ||
+    /\bMindSpacePageData\b/.test(content)
+  );
+}
+
 export function detectPageDataDatasetUsageFromHtml(html) {
   const text = String(html ?? '');
   const datasets = new Map();
@@ -20,6 +32,16 @@ export function detectPageDataDatasetUsageFromHtml(html) {
   return datasets;
 }
 
+export function inferPageDataBindAccessMode(relativePath, html) {
+  const usage = detectPageDataDatasetUsageFromHtml(html);
+  const hasRead = [...usage.values()].some((item) => item.read);
+  const hasInsert = [...usage.values()].some((item) => item.insert);
+  if (/-admin\.html$/i.test(String(relativePath ?? '')) || (hasRead && !hasInsert)) {
+    return 'password';
+  }
+  return 'public';
+}
+
 export function assertPolicyMatchesHtmlDatasets(html, policyDatasets) {
   const usage = detectPageDataDatasetUsageFromHtml(html);
   const htmlNames = [...usage.keys()].sort();