fix: gate public page download links before Portal release

Add a MindSpace public HTML checker for missing companion docx/PDF paths, wire it into runtime packaging and release-portal-runtime-prod.sh, and document the workflow for agents and ops.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/发包必看.md

@@ -36,8 +36,11 @@ rm -f /Users/john/PycharmProjects/test/test-memind-release-goosed-mcp/node_modul
 
 ```bash
 node --test db.test.mjs capabilities.test.mjs llm-providers.test.mjs wechat-mp.test.mjs
+npm run check:mindspace-public-links
 ```
 
+6. `public/*.html` 里的**下载/附件**相对链接（如 `report.docx`）必须在同目录真实存在。发版脚本默认只查这类链接（`--downloads-only`）；全量资源检查用 `npm run check:mindspace-public-links:all`。失败会阻断发版；确知要带着已知坏链上线时，才可临时 `ALLOW_MINDSPACE_PUBLIC_LINK_ISSUES=1`。
+
 ## 2. Portal runtime 发布唯一流程
 
 只使用：
@@ -55,6 +58,7 @@ bash scripts/release-portal-runtime-prod.sh --skip-tests --yes
 - 原子切换 live 目录。
 - 更新 LaunchAgent 指向 `/Users/john/Project/Memind/scripts/run-memind-portal-prod.sh`。
 - 健康检查 `http://127.0.0.1:8081/api/status` 返回 200。
+- 校验 `MindSpace/*/public/*.html` 下载/附件相对链接均已落盘（`check-mindspace-public-links.mjs --downloads-only`）。
 
 发布成功后，记录脚本输出里的：
 
@@ -86,6 +90,7 @@ ssh john@58.38.22.103 '
     printf "goosed_${p}="
     curl -k -s -o /dev/null -w "%{http_code}\n" https://127.0.0.1:${p}/status
   done
+  cd /Users/john/Project/Memind && node scripts/check-mindspace-public-links.mjs --root MindSpace --downloads-only
   pid=$(pgrep -f "node .*server.mjs" | head -1)
   echo "portal_pid=${pid}"
   ps eww -p "$pid" | tr " " "\n" | awk -F= "/^(DATABASE_URL|H5_PORT|TKMIND_API_TARGETS|GOOSED_MCP_NODE_PATH|GOOSED_MCP_SERVER_PATH)=/ {print \$1\"=SET\"}"