参考所有分组，完成尽量多的内容。禁止顺手扩功能 smoke：锁定build-wasm源码映射前置

结论：build-wasm.sh 现在与 native/source-link 一样先运行六分组 source-map guards，再消费生成配置别名和浏览器 artifacts；同步 build/workstreams source map 与 aggregate 元检查。未新增 CNC 行为，未扩展 smoke fallback。\n\n测试：./check-linuxcnc-workstreams-source-map.sh；./check-linuxcnc-build-source-map.sh；git diff --check；CNC_SIM_ALL_NATIVE_GUARDRAILS_ONLY=1 ./test-all-native.sh；./test-native.sh；./test-linuxcnc-source-link.sh。

check-linuxcnc-workstreams-source-map.sh

@@ -118,7 +118,7 @@ for workstream, paths in expected.items():
         if path.startswith("check-") and not Path(path).stat().st_mode & 0o111:
             raise SystemExit(f"source-map guard is not executable: {path}")
 
-for test_entry in ["test-native.sh", "test-linuxcnc-source-link.sh"]:
+for test_entry in ["test-native.sh", "test-linuxcnc-source-link.sh", "build-wasm.sh"]:
     text = Path(test_entry).read_text(encoding="utf-8")
     for guard in sorted({path for paths in expected.values() for path in paths if path.startswith("check-")}):
         if f"./{guard}" not in text: