参考所有分组，完成尽量多的内容：收紧OPFS source-map边界守卫

docs/linuxcnc-opfs-source-map.md

@@ -47,6 +47,11 @@ persistence. It is a policy and bridge map only; it must not add independent fil
 - `web/src/app.js` must parse browser programs through
   `parseFileWithParameterFile()` so the program file and LinuxCNC parameter
   state both live under OPFS.
+- `test-native.sh`, `test-linuxcnc-source-link.sh`, and `build-wasm.sh` must
+  run `./check-linuxcnc-opfs-source-map.sh` before consuming app-backed browser
+  artifacts or source-linked LinuxCNC objects.
+- The OPFS source-map guard validates LinuxCNC source-backed filesystem bridge
+  policy only; it does not interpret G-code.
 
 ## Checks
 
@@ -56,6 +61,7 @@ Run:
 ./check-linuxcnc-opfs-source-map.sh
 ./test-native.sh
 ./test-linuxcnc-source-link.sh
+./build-wasm.sh
 ```
 
 `check-linuxcnc-opfs-source-map.sh` keeps this document, the LinuxCNC source