chore: harden h5 launch evidence gate

docs/refactor/production-launch-evidence.template.json

@@ -213,6 +213,29 @@
         "failed": 0
       }
     },
+    {
+      "id": "taro.h5-static-smoke",
+      "status": "pass",
+      "command": "npm --silent run smoke:taro:h5 -- --json > docs/refactor/launch-artifacts/taro-h5-static-smoke.json",
+      "completedAt": "2026-06-30T12:12:00+08:00",
+      "artifact": "launch-artifacts/taro-h5-static-smoke.json",
+      "summary": {
+        "fail": 0,
+        "portals": 3,
+        "tenantResolveRequests": 3
+      }
+    },
+    {
+      "id": "taro.h5-release-guardrails",
+      "status": "pass",
+      "command": "node scripts/taro-h5-release-guardrails-test.js --require-dist --require-runtime-config --json > docs/refactor/launch-artifacts/taro-h5-release-guardrails.json",
+      "completedAt": "2026-06-30T12:15:00+08:00",
+      "artifact": "launch-artifacts/taro-h5-release-guardrails.json",
+      "summary": {
+        "fail": 0,
+        "warn": 0
+      }
+    },
     {
       "id": "audit.runtime",
       "status": "pass",
@@ -226,13 +249,13 @@
     },
     {
       "id": "security.codex-scan",
-      "status": "pass",
-      "command": "@codex-security scan; save findings to docs/refactor/launch-artifacts/codex-security.md",
-      "completedAt": "2026-06-30T12:30:00+08:00",
+      "status": "replace-with-pass-after-real-scan",
+      "command": "Run the real @codex-security scan only when the tool is exposed; save findings to docs/refactor/launch-artifacts/codex-security.md",
+      "completedAt": "replace-with-real-scan-time",
       "artifact": "launch-artifacts/codex-security.md",
       "summary": {
-        "critical": 0,
-        "high": 0
+        "critical": "replace-with-number",
+        "high": "replace-with-number"
       }
     }
   ],