完善桌面端界面、发布检查与邮箱域名同步

docs/guides/client-release.md

@@ -64,6 +64,7 @@ release/security gate before promotion:
 ```bash
 cd frontend
 npm run version:check
+npm run release:env:check
 npm run runtime:check
 npm run desktop:release:check
 npm run ui:contract
@@ -73,10 +74,12 @@ npm run build
 npm run desktop:build:app
 ```
 
+`release:env:check` verifies build channel and commit metadata, and can be
+made strict for signed Desktop builds with `REQUIRE_DESKTOP_SIGNING=true`.
 `desktop:release:check` statically verifies the Tauri bundle, updater public
-key, CSP, capability scopes, command allowlist, query-token ban, and secure
-session token boundary. The full manual release, security, regression, and
-Desktop UX checklist lives in
+key, CSP, capability scopes, command allowlist, query-token ban, generic system
+notification boundary, CI gate coverage, and secure session token boundary. The
+full manual release, security, regression, and Desktop UX checklist lives in
 `docs/audits/desktop-release-stabilization-checklist.md`.
 
 ## Promotion
@@ -120,8 +123,9 @@ The release pipeline must:
 3. sign and notarize the macOS app;
 4. produce updater artifacts and `.sig` files with the updater private key;
 5. generate `latest.json` and a checksum manifest;
-6. upload immutable artifacts first;
-7. atomically replace `latest.json` last.
+6. verify the feed with `npm run desktop:update-feed:check -- --feed <latest.json> --artifacts-dir <artifact-dir>`;
+7. upload immutable artifacts first;
+8. atomically replace `latest.json` last.
 
 For Universal macOS artifacts, `latest.json` must provide both
 `darwin-aarch64` and `darwin-x86_64` entries pointing at the same Universal
@@ -149,6 +153,9 @@ Windows validation must cover:
 cd frontend
 npm ci
 npm run version:check
+export VITE_BUILD_CHANNEL=release
+export VITE_BUILD_COMMIT="$(git rev-parse HEAD)"
+npm run release:env:check
 npm run runtime:check
 npm run desktop:release:check
 npm run ui:contract
@@ -158,7 +165,10 @@ npm run build
 npm run desktop:build:app
 export TAURI_SIGNING_PRIVATE_KEY="$UPDATER_PRIVATE_KEY"
 export TAURI_SIGNING_PRIVATE_KEY_PASSWORD="$UPDATER_PRIVATE_KEY_PASSWORD"
+export REQUIRE_DESKTOP_SIGNING=true
+npm run release:env:check
 npm run desktop:build -- --bundles app
+npm run desktop:update-feed:check -- --feed src-tauri/target/release/bundle/latest.json --artifacts-dir src-tauri/target/release/bundle
 ```
 
 The Desktop build must run on macOS for the current first-phase target. A signed