参考所有分组，完成尽量多的内容：收紧browser-app source-map边界守卫

check-linuxcnc-browser-app-source-map.sh

@@ -7,7 +7,7 @@ cd "$(dirname "$0")"
 # LinuxCNC RS274 parameter-file defaults, rs274ngc_pre.cc restore/save/read
 # file semantics, and the existing OPFS-backed wasm-core bridge. It validates
 # app integration policy only; it does not add CNC behavior or expand smoke
-# parsing.
+# parsing, or interpret G-code.
 linuxcnc_root=${LINUXCNC_ROOT:-../linuxcnc}
 linuxcnc_root=$(cd "$linuxcnc_root" && pwd)
 
@@ -104,10 +104,20 @@ for phrase in [
     "parameters/rs274ngc.var",
     "visible backend selector must stay limited",
     "./check-linuxcnc-browser-app-source-map.sh",
+    "does not interpret G-code",
 ]:
     if phrase not in source_map:
         raise SystemExit(f"docs/linuxcnc-browser-app-source-map.md missing boundary phrase: {phrase}")
 
+for entry in [
+    "test-native.sh",
+    "test-linuxcnc-source-link.sh",
+    "build-wasm.sh",
+]:
+    text = Path(entry).read_text(encoding="utf-8")
+    if "./check-linuxcnc-browser-app-source-map.sh" not in text:
+        raise SystemExit(f"{entry} must run ./check-linuxcnc-browser-app-source-map.sh")
+
 app = Path("web/src/app.js").read_text(encoding="utf-8")
 if "parse(" in app.replace("parseProgram", ""):
     raise SystemExit("browser app should route program execution through parseFileWithParameterFile, not direct parse")