接入发布候选回执强制校验（09-06-release-gate-integrity）

scripts/qa/tests/fixtures/release-fs-guard.cjs

@@ -0,0 +1,15 @@
+// Loaded only in private fixture children; audit config access without real HOME.
+const fs = require('node:fs');
+const path = require('node:path');
+const { syncBuiltinESMExports } = require('node:module');
+const root = process.env.HYB_RELEASE_FIXTURE_ROOT;
+const original = fs.readFileSync;
+fs.readFileSync = function(file, ...args) {
+  const text = String(file);
+  if (text.endsWith('/.ssh/config') || /\/\.env(?:$|\.)/.test(text)) {
+    if (text !== path.join(root, 'bin/home/.ssh/config')) throw Error('fixture_config_read_forbidden');
+    fs.appendFileSync(path.join(root, 'artifacts/commands.jsonl'), JSON.stringify({ name: 'config-read', args: ['synthetic-ssh'] }) + '\n');
+  }
+  return original.call(this, file, ...args);
+};
+syncBuiltinESMExports();