fix: gate public page download links before Portal release

Add a MindSpace public HTML checker for missing companion docx/PDF paths, wire it into runtime packaging and release-portal-runtime-prod.sh, and document the workflow for agents and ops.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/build-portal-runtime.mjs

@@ -184,6 +184,19 @@ async function rewriteNodeModulesSymlinks(runtimeNodeModulesDir, sourceNodeModul
   await visit(runtimeNodeModulesDir);
 }
 
+async function copyMindspacePublicLinkTools() {
+  console.log('==> 拷贝 MindSpace 公开页链接检查工具');
+  await fs.copyFile(
+    path.join(root, 'mindspace-public-links.mjs'),
+    path.join(runtimeRoot, 'mindspace-public-links.mjs'),
+  );
+  await fs.mkdir(path.join(runtimeRoot, 'scripts'), { recursive: true });
+  await fs.copyFile(
+    path.join(root, 'scripts', 'check-mindspace-public-links.mjs'),
+    path.join(runtimeRoot, 'scripts', 'check-mindspace-public-links.mjs'),
+  );
+}
+
 async function writeMetadata() {
   const packageJson = JSON.parse(await fs.readFile(path.join(root, 'package.json'), 'utf8'));
   const runtimeDependencies = Object.fromEntries(
@@ -272,6 +285,9 @@ async function writeMetadata() {
       'Bundled alongside server.mjs (required for sandbox-fs MCP):',
       '  mindspace-sandbox-mcp.mjs  (esbuild bundle; includes schedule-service deps)',
       '',
+      'Post-deploy validation (scripts/check-mindspace-public-links.mjs):',
+      '  Scans MindSpace/*/public/*.html for missing relative href/src/cover targets.',
+      '',
       `Runtime install mode: ${runtimeInstallMode}`,
       `Bundle target: ${runtimeNodeTarget}`,
       '',
@@ -302,6 +318,7 @@ async function main() {
   if (runtimeInstallMode === 'bundle-node-modules' && !skipNodeModules) {
     await copyNodeModules();
   }
+  await copyMindspacePublicLinkTools();
   await writeMetadata();
   await fs.chmod(path.join(runtimeRoot, 'scripts', 'run-memind-portal-prod.sh'), 0o755);
   await fs.chmod(path.join(runtimeRoot, 'scripts', 'wechat-mp-menu.mjs'), 0o755);