fix(updates): verify readable frontend assets before reopening traffic

Keep backups private while publishing build directories as 755 and files as 644. Verify the served entry, JS/CSS and service worker before success. Document cache policy for stable widget and runtime entry URLs.

deploy/server/tests/test_updater.py

@@ -160,3 +160,30 @@ def test_interrupted_build_does_not_leave_a_permanently_busy_job(cfg):
     deployment.Deployment(cfg).recover()
     assert state.read(cfg)['update']['status'] == 'failed'
     assert state.read(cfg)['current']['revision'] == CURRENT
+
+
+def test_public_build_permissions_do_not_inherit_private_backup_umask(tmp_path):
+    root = tmp_path / 'dashboard'
+    root.mkdir(mode=0o700)
+    (root / 'assets').mkdir(mode=0o700)
+    (root / 'assets/main.js').write_text('export default {}')
+    (root / 'assets/main.js').chmod(0o600)
+    deployment.Deployment.publish_permissions(root)
+    assert root.stat().st_mode & 0o777 == 0o755
+    assert (root / 'assets').stat().st_mode & 0o777 == 0o755
+    assert (root / 'assets/main.js').stat().st_mode & 0o777 == 0o644
+
+
+def test_frontend_verification_rejects_html_instead_of_javascript(cfg, monkeypatch):
+    web = Path(cfg['project_dir']) / 'deploy/local/.state/dashboard'
+    web.mkdir(parents=True)
+    html = b'<html><script type="module" src="/assets/main.js"></script></html>'
+    (web / 'index.html').write_bytes(html)
+    class Response:
+        headers = {'Content-Type': 'text/html'}
+        def __enter__(self): return self
+        def __exit__(self, *_): return False
+        def read(self): return html
+    monkeypatch.setattr(deployment.urllib.request, 'urlopen', lambda *a, **k: Response())
+    with pytest.raises(RuntimeError, match='静态资源响应异常'):
+        deployment.Deployment(cfg).verify_frontend()