参考所有分组，完成尽量多的内容。禁止顺手扩功能 smoke：锁定build-wasm源码映射前置

结论：build-wasm.sh 现在与 native/source-link 一样先运行六分组 source-map guards，再消费生成配置别名和浏览器 artifacts；同步 build/workstreams source map 与 aggregate 元检查。未新增 CNC 行为，未扩展 smoke fallback。\n\n测试：./check-linuxcnc-workstreams-source-map.sh；./check-linuxcnc-build-source-map.sh；git diff --check；CNC_SIM_ALL_NATIVE_GUARDRAILS_ONLY=1 ./test-all-native.sh；./test-native.sh；./test-linuxcnc-source-link.sh。

docs/linuxcnc-build-source-map.md

@@ -29,7 +29,7 @@ behavior and must not expand the temporary smoke parser.
 | `test-linuxcnc-source-link.sh` | Compiles manifest-selected LinuxCNC RS274 objects directly with source-link support objects and project dump bridges. |
 | `test-linuxcnc-source-syntax.sh` | Keeps native source syntax validation on persistent dependency-tracked stamps. |
 | `test-linuxcnc-wasm-cmake-safe-probe.sh` | Configures source-backed WASM-safe probe targets with persistent CMake signatures. |
-| `build-wasm.sh` | Runs blocker, syntax, object, CMake, tooldata, interp, Python, `rs274ngc_pre`, and runtime probes before copying browser artifacts. |
+| `build-wasm.sh` | Runs source-map guards, blocker, syntax, object, CMake, tooldata, interp, Python, `rs274ngc_pre`, and runtime probes before copying browser artifacts. |
 
 ## Boundaries
 
@@ -41,6 +41,8 @@ behavior and must not expand the temporary smoke parser.
   `CONFIGURE_RULE_VERSION` fields instead of hashing whole scripts.
 - `build-wasm.sh` must configure with `CNC_SIM_ENABLE_SMOKE_BACKEND=OFF` and
   `CNC_SIM_ENABLE_LINUXCNC_WASM_SAFE_PROBE=ON`.
+- `build-wasm.sh` must run the same source-map guards as native and source-link
+  entry points before consuming generated config aliases or browser artifacts.
 - `build-wasm.sh` must build `cnc_sim_wasm_runtime_probe` before
   `cnc_sim_wasm`, copy `cnc_sim.js` and `cnc_sim.wasm` exactly once, compare
   copied artifacts with `cmp -s`, and run Node smoke before browser smoke.