fix(GOV-009): 完成最终复审整改

tools/boundaries/verify-project-boundaries.mjs

@@ -20,6 +20,12 @@ async function collectSourceFiles(directory) {
 
 function extractTypeScriptSource(sourcePath, sourceText) {
   if (path.extname(sourcePath) !== '.vue') return sourceText;
+  const externalScript = sourceText.match(/<script\b[^>]*\bsrc\s*=\s*["']([^"']+)["'][^>]*>/i);
+  if (externalScript) {
+    throw new Error(
+      `Web Vue 组件禁止使用外部 script src：${path.basename(sourcePath)} -> ${externalScript[1]}`,
+    );
+  }
   // 边界门禁只需解析 SFC 的脚本块；模板和样式不会产生 TypeScript 模块依赖。
   return [...sourceText.matchAll(/<script\b[^>]*>([\s\S]*?)<\/script>/gi)]
     .map((match) => match[1])
@@ -65,6 +71,9 @@ function resolvesInsideServer(specifier, sourcePath, repositoryRoot, compilerOpt
   return candidate === serverRoot || candidate.startsWith(`${serverRoot}${path.sep}`);
 }
 
+/**
+ * 扫描 Web TypeScript 与 Vue 脚本，阻断对 Server 源码和内部消息契约的反向依赖。
+ */
 export async function verifyProjectBoundaries(repositoryRoot) {
   const webSourceRoot = path.join(repositoryRoot, 'web', 'src');
   const configPath = path.join(repositoryRoot, 'web', 'tsconfig.json');