fix(GOV-009): 完成最终复审整改

tools/boundaries/verify-project-boundaries.mjs

@@ -20,6 +20,12 @@ async function collectSourceFiles(directory) {
 
 function extractTypeScriptSource(sourcePath, sourceText) {
   if (path.extname(sourcePath) !== '.vue') return sourceText;
+  const externalScript = sourceText.match(/<script\b[^>]*\bsrc\s*=\s*["']([^"']+)["'][^>]*>/i);
+  if (externalScript) {
+    throw new Error(
+      `Web Vue 组件禁止使用外部 script src：${path.basename(sourcePath)} -> ${externalScript[1]}`,
+    );
+  }
   // 边界门禁只需解析 SFC 的脚本块；模板和样式不会产生 TypeScript 模块依赖。
   return [...sourceText.matchAll(/<script\b[^>]*>([\s\S]*?)<\/script>/gi)]
     .map((match) => match[1])
@@ -65,6 +71,9 @@ function resolvesInsideServer(specifier, sourcePath, repositoryRoot, compilerOpt
   return candidate === serverRoot || candidate.startsWith(`${serverRoot}${path.sep}`);
 }
 
+/**
+ * 扫描 Web TypeScript 与 Vue 脚本，阻断对 Server 源码和内部消息契约的反向依赖。
+ */
 export async function verifyProjectBoundaries(repositoryRoot) {
   const webSourceRoot = path.join(repositoryRoot, 'web', 'src');
   const configPath = path.join(repositoryRoot, 'web', 'tsconfig.json');

tools/boundaries/verify-project-boundaries.test.mjs

@@ -108,6 +108,20 @@ const value: Internal | undefined = undefined;
   assert.match(result.stderr, /IllegalView\.vue/);
 });
 
+test('拒绝 Vue 外部 script src 绕过源码边界', async () => {
+  const repositoryRoot = await createFixture();
+  await writeFile(
+    path.join(repositoryRoot, 'web/src/ExternalScript.vue'),
+    `<script setup lang="ts" src="../../server/libs/internal.ts"></script>\n<template><main /></template>\n`,
+  );
+
+  const result = await runChecker(repositoryRoot);
+
+  assert.equal(result.exitCode, 1);
+  assert.match(result.stderr, /禁止使用外部 script src/);
+  assert.match(result.stderr, /ExternalScript\.vue/);
+});
+
 test('接受只消费公开 OpenAPI 类型的 Web 工程', async () => {
   const repositoryRoot = await createFixture();
   await writeFile(