参考所有分组，完成尽量多的内容。禁止顺手扩功能 smoke

结论：收敛第 5/6 组 Node/browser smoke wrapper 约束，all-native guardrail 验证 WASM_NODE_SMOKE_MIN_STEPS 和 BROWSER_SMOKE_MIN_SECTIONS 非法阈值会被 wrapper 直接拒绝，避免 smoke 覆盖门槛被误配置；未扩展 smoke 功能。验证：CNC_SIM_ALL_NATIVE_GUARDRAILS_ONLY=1 ./test-all-native.sh、./test-native.sh、./test-linuxcnc-source-link.sh 均通过。

test-all-native.sh

@@ -47,6 +47,8 @@ invalid_build_jobs_log=$(mktemp "${TMPDIR:-/tmp}/cnc_sim_invalid_build_jobs.XXXX
 invalid_build_dir_log=$(mktemp "${TMPDIR:-/tmp}/cnc_sim_invalid_build_dir.XXXXXX.log")
 empty_build_dir_log=$(mktemp "${TMPDIR:-/tmp}/cnc_sim_empty_build_dir.XXXXXX.log")
 whitespace_build_dir_log=$(mktemp "${TMPDIR:-/tmp}/cnc_sim_whitespace_build_dir.XXXXXX.log")
+invalid_node_smoke_min_steps_log=$(mktemp "${TMPDIR:-/tmp}/cnc_sim_invalid_node_smoke_min_steps.XXXXXX.log")
+invalid_browser_smoke_min_sections_log=$(mktemp "${TMPDIR:-/tmp}/cnc_sim_invalid_browser_smoke_min_sections.XXXXXX.log")
 
 cleanup_native_test_temps() {
     rm -f \
@@ -81,7 +83,9 @@ cleanup_native_test_temps() {
         "$invalid_build_jobs_log" \
         "$invalid_build_dir_log" \
         "$empty_build_dir_log" \
-        "$whitespace_build_dir_log"
+        "$whitespace_build_dir_log" \
+        "$invalid_node_smoke_min_steps_log" \
+        "$invalid_browser_smoke_min_sections_log"
 }
 trap cleanup_native_test_temps EXIT
 
@@ -198,7 +202,9 @@ for forbidden_manual_cleanup in \
     'rm -f "$invalid_build_jobs_log"' \
     'rm -f "$invalid_build_dir_log"' \
     'rm -f "$empty_build_dir_log"' \
-    'rm -f "$whitespace_build_dir_log"'; do
+    'rm -f "$whitespace_build_dir_log"' \
+    'rm -f "$invalid_node_smoke_min_steps_log"' \
+    'rm -f "$invalid_browser_smoke_min_sections_log"'; do
     if grep -Fx "$forbidden_manual_cleanup" test-all-native.sh >/dev/null; then
         echo "native aggregate test still relies on manual cleanup: $forbidden_manual_cleanup" >&2
         exit 1
@@ -655,6 +661,24 @@ grep -F 'must copy `build/wasm/cnc_sim.js` and' docs/linuxcnc-source-policy.md >
 grep -F 'must compare copied artifacts with `cmp -s` before running' docs/linuxcnc-source-policy.md >/dev/null
 grep -F 'must run `test-web-wasm-node-smoke.sh` before the browser' docs/linuxcnc-source-policy.md >/dev/null
 grep -F 'test-web-wasm-node-smoke.sh' docs/linuxcnc-porting.md >/dev/null
+if WASM_NODE_SMOKE_MIN_STEPS=0 ./test-web-wasm-node-smoke.sh >"$invalid_node_smoke_min_steps_log" 2>&1; then
+    echo "WASM Node smoke wrapper accepted invalid minimum step count" >&2
+    exit 1
+fi
+if ! grep -F "WASM_NODE_SMOKE_MIN_STEPS must be a positive integer: 0" "$invalid_node_smoke_min_steps_log" >/dev/null; then
+    echo "WASM Node smoke wrapper did not report invalid minimum step count clearly" >&2
+    sed -n '1,20p' "$invalid_node_smoke_min_steps_log" >&2
+    exit 1
+fi
+if BROWSER_SMOKE_MIN_SECTIONS=0 ./test-web-wasm-browser-smoke.sh >"$invalid_browser_smoke_min_sections_log" 2>&1; then
+    echo "WASM browser smoke wrapper accepted invalid minimum section count" >&2
+    exit 1
+fi
+if ! grep -F "BROWSER_SMOKE_MIN_SECTIONS must be a positive integer: 0" "$invalid_browser_smoke_min_sections_log" >/dev/null; then
+    echo "WASM browser smoke wrapper did not report invalid minimum section count clearly" >&2
+    sed -n '1,20p' "$invalid_browser_smoke_min_sections_log" >&2
+    exit 1
+fi
 grep -F 'explicitly checked for 26' docs/linuxcnc-source-policy.md >/dev/null
 grep -F 'wasm-safe core sources and 9 blocked sources' docs/linuxcnc-source-policy.md >/dev/null
 grep -F 'must reject malformed lines, absolute source paths,' docs/linuxcnc-source-policy.md >/dev/null