fix(GOV-009): 完成仅源码部署最终复审

tools/deployment/verify-source-deployment.mjs

@@ -1,4 +1,4 @@
-import { access, readFile } from 'node:fs/promises';
+import { access, readFile, readdir } from 'node:fs/promises';
 import path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath } from 'node:url';
@@ -32,6 +32,16 @@ const serverProcesses = Object.freeze([
   ['worker', 'Worker'],
 ]);
 
+const ignoredScanDirectories = new Set([
+  '.git',
+  '.gitnexus',
+  '.local',
+  'dist',
+  'node_modules',
+  'playwright-report',
+  'test-results',
+]);
+
 function resolveRoot(repositoryRoot) {
   return repositoryRoot instanceof URL
     ? fileURLToPath(repositoryRoot)
@@ -54,6 +64,34 @@ async function assertDockerArtifactsAbsent(repositoryRoot) {
       throw new Error(`禁止存在 Docker 活动文件：${relativePath}`);
     }
   }
+
+  const pendingDirectories = [repositoryRoot];
+  while (pendingDirectories.length > 0) {
+    const currentDirectory = pendingDirectories.pop();
+    const entries = await readdir(currentDirectory, { withFileTypes: true });
+
+    for (const entry of entries) {
+      if (entry.isDirectory() && ignoredScanDirectories.has(entry.name)) continue;
+      const absolutePath = path.join(currentDirectory, entry.name);
+      if (entry.isDirectory()) {
+        pendingDirectories.push(absolutePath);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+
+      const relativePath = path.relative(repositoryRoot, absolutePath).split(path.sep).join('/');
+      const segments = relativePath.split('/');
+      const fileName = segments.at(-1);
+      const isDockerfile = /^Dockerfile(?:\..+)?$/i.test(fileName);
+      const isDockerIgnore = fileName === '.dockerignore';
+      const isDockerCompose = /^docker-compose.*\.ya?ml$/i.test(fileName);
+      const isComposeYaml = segments.includes('compose') && /\.ya?ml$/i.test(fileName);
+
+      if (isDockerfile || isDockerIgnore || isDockerCompose || isComposeYaml) {
+        throw new Error(`禁止存在 Docker 活动文件：${relativePath}`);
+      }
+    }
+  }
 }
 
 async function assertBuildOutputsPresent(repositoryRoot) {