fix: gate public page download links before Portal release

Add a MindSpace public HTML checker for missing companion docx/PDF paths, wire it into runtime packaging and release-portal-runtime-prod.sh, and document the workflow for agents and ops.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/release-portal-runtime-prod.sh

@@ -151,7 +151,7 @@ fi
 
 verify_runtime_artifact() {
   local missing=0
-  for required in server.mjs mindspace-sandbox-mcp.mjs dist package.json scripts/run-memind-portal-prod.sh scripts/load-env.mjs scripts/wechat-mp-menu.mjs scripts/memind-portal-tunnel.sh; do
+  for required in server.mjs mindspace-sandbox-mcp.mjs mindspace-public-links.mjs dist package.json scripts/run-memind-portal-prod.sh scripts/check-mindspace-public-links.mjs scripts/load-env.mjs scripts/wechat-mp-menu.mjs scripts/memind-portal-tunnel.sh; do
     if [[ ! -e "${RUNTIME_ROOT}/${required}" ]]; then
       echo "runtime 产物缺失: ${RUNTIME_ROOT}/${required}" >&2
       missing=1
@@ -171,6 +171,29 @@ say "验证 MindSpace 发布与聊天 Finish 回归守卫"
   npm run verify:mindspace-publish-guards:full
 )
 
+verify_mindspace_public_links() {
+  local target_root="${1:-${ROOT}/MindSpace}"
+  local label="${2:-本地 MindSpace}"
+  if [[ "${ALLOW_MINDSPACE_PUBLIC_LINK_ISSUES:-0}" == "1" ]]; then
+    say "跳过 ${label} 公开页链接检查（ALLOW_MINDSPACE_PUBLIC_LINK_ISSUES=1）"
+    return 0
+  fi
+  if [[ ! -d "${target_root}" ]]; then
+    say "跳过 ${label} 公开页链接检查（目录不存在: ${target_root}）"
+    return 0
+  fi
+  say "检查 ${label} 公开页相对链接"
+  if ! node "${ROOT}/scripts/check-mindspace-public-links.mjs" --root "${target_root}" --downloads-only; then
+    echo "MindSpace 公开页存在缺失的相对下载/资源链接。" >&2
+    echo "修复 public/*.html 中的 href/src/cover 路径，或临时设置 ALLOW_MINDSPACE_PUBLIC_LINK_ISSUES=1 跳过。" >&2
+    exit 1
+  fi
+}
+
+if [[ "${DRY_RUN}" -ne 1 ]]; then
+  verify_mindspace_public_links "${ROOT}/MindSpace" "本地"
+fi
+
 verify_remote_goosed_dependency() {
   say "检查 103 goosed 依赖"
   ssh -o BatchMode=yes "${HOST}" 'bash -s' <<'REMOTE'
@@ -500,6 +523,19 @@ if [[ "${portal_code}" != "200" ]]; then
   exit 1
 fi
 
+if [[ "${ALLOW_MINDSPACE_PUBLIC_LINK_ISSUES:-0}" != "1" && -d "${APP_DIR}/MindSpace" && -f "${APP_DIR}/scripts/check-mindspace-public-links.mjs" ]]; then
+  say "检查 MindSpace 公开页相对链接"
+  node_bin="/opt/homebrew/opt/node@24/bin/node"
+  if [[ ! -x "${node_bin}" ]]; then
+    node_bin="$(command -v node)"
+  fi
+  if ! "${node_bin}" "${APP_DIR}/scripts/check-mindspace-public-links.mjs" --root "${APP_DIR}/MindSpace" --downloads-only; then
+    echo "MindSpace public link check failed: broken relative download/asset links under public/*.html" >&2
+    echo "Set ALLOW_MINDSPACE_PUBLIC_LINK_ISSUES=1 only if you accept shipping with known broken links." >&2
+    exit 1
+  fi
+fi
+
 say "重启 m.tkmind.cn 反向隧道"
 ensure_portal_tunnel
 
@@ -507,6 +543,7 @@ say "检查 live 目录中不再保留源码树"
 allowed_live_mjs=(
   "${APP_DIR}/server.mjs"
   "${APP_DIR}/mindspace-sandbox-mcp.mjs"
+  "${APP_DIR}/mindspace-public-links.mjs"
 )
 extra_files=""
 while IFS= read -r file; do