接续上一轮：推进浏览器验证与M428配置收拢

结论：已完成浏览器侧真实加载验证，M428/M429/M430 的配置入口进一步从 LinuxCNC INI/HALFILE/REMAP 来源生成，native 与 source-link 验证通过。

analyze-linuxcnc-wasm-blockers.sh

@@ -22,18 +22,37 @@ core_native_fs_sources=()
 core_count=0
 blocked_count=0
 blocked_replacements=()
+shim_source_output=$(./list-linuxcnc-wasm-safe-shims.sh)
+mapfile -t wasm_safe_shims <<<"$shim_source_output"
 
 blocked_replacement_for() {
     case "$1" in
         src/emc/tooldata/tooldata_mmap.cc)
             ./list-linuxcnc-wasm-safe-shims.sh tooldata_mmap_backend.cc
             ;;
+        src/emc/rs274ngc/canonmodule.cc|src/emc/rs274ngc/gcodemodule.cc|src/emc/rs274ngc/interpmodule.cc)
+            ./list-linuxcnc-wasm-safe-shims.sh linuxcnc_runtime_shim.cc
+            ;;
+        src/emc/rs274ngc/pyarrays.cc|src/emc/rs274ngc/pyblock.cc|src/emc/rs274ngc/pyemctypes.cc|src/emc/rs274ngc/pyinterp1.cc|src/emc/rs274ngc/pyparamclass.cc)
+            ./list-linuxcnc-wasm-safe-shims.sh python_c_api_shim.cc
+            ;;
         *)
             return 1
             ;;
     esac
 }
 
+wasm_safe_shim_in_build() {
+    local shim=$1
+    local candidate
+    for candidate in "${wasm_safe_shims[@]}"; do
+        if [[ "$candidate" == "$shim" ]]; then
+            return 0
+        fi
+    done
+    return 1
+}
+
 core_source_output=$(./list-linuxcnc-wasm-manifest-sources.sh "$manifest" core)
 mapfile -t core_sources <<<"$core_source_output"
 blocked_source_output=$(./list-linuxcnc-wasm-manifest-sources.sh "$manifest" blocked)
@@ -56,6 +75,10 @@ scan_source() {
             echo "missing blocked replacement source: $replacement" >&2
             exit 1
         fi
+        if ! wasm_safe_shim_in_build "$replacement"; then
+            echo "blocked replacement is not in wasm shim build set: $path -> $replacement" >&2
+            exit 1
+        fi
         blocked_replacements+=("$path -> $replacement")
     fi