H-328: codify frontend delivery checks (#57)

Co-authored-by: Rogee <rogee@ipao.vip>

README.md

@@ -119,8 +119,14 @@ pnpm dev                  # 同时启动前后端
 
 # 单独构建前端
 pnpm build:frontend       # 生产构建 → frontend/dist/
+
+# 校验前端可重复交付基线
+pnpm verify:frontend:delivery # frozen install + 构建产物检查 + 生产依赖 high/critical 漏洞扫描
 ```
 
+前端交付以仓库提交的 `pnpm-lock.yaml` 为准；依赖变更必须同步提交 lockfile，交付前运行上述校验。
+无锁重新解析会随 semver、peer 和可选平台依赖变化，不作为完整依赖图一致性目标。
+
 Vite dev server 会将 `/api`、`/platform`、`/cable`、`/health` 代理到 GoChat 后端
 （默认 `http://127.0.0.1:3000`，可通过 `VITE_API_HOST` 环境变量覆盖）。
 

package.json

@@ -9,6 +9,7 @@
     "dev:shangwutong": "cd channels/shangwutong && mkdir -p tmp && SWT_CONNECTOR_DB_PATH=${SWT_CONNECTOR_DB_PATH:-$PWD/tmp/connector.db} GOCHAT_BASE_URL=${GOCHAT_BASE_URL:-http://127.0.0.1:3000} GOCHAT_CONNECTOR_SERVICE_TOKEN=${GOCHAT_CONNECTOR_SERVICE_TOKEN:-dev-connector-token} go run ./cmd/shangwutong serve",
     "dev": "concurrently -n backend,frontend -c blue,green \"pnpm dev:backend\" \"pnpm dev:frontend\"",
     "build:frontend": "cd frontend && pnpm build",
+    "verify:frontend:delivery": "pnpm install --frozen-lockfile && pnpm --dir frontend test:build && pnpm audit --prod --audit-level high",
     "build:sdk": "cd frontend && pnpm build:sdk",
     "lint:frontend": "cd frontend && pnpm eslint",
     "test:frontend": "cd frontend && pnpm test",