feat(S6-P21): 组件族参数化(13族/44成员/导航族15文件同源/79→48概念组件)

【本次核心 · S6-P21】
- 族层数据：families.json + 44 份契约注入 family/familyRole/familyParams；
  data.json / data.js / site/details 同步。13 族 / 44 成员 / 35 独立 → 概念组件 79→48。
- 79 个 slug 全保留、集合逐一不变（铁律 5 对外承诺未破）；frameworks 仍 395 文件、薄壳仍 79。
- 归族判据为契约中可核对字段（semanticTypeCandidates 重叠 / anatomy 为同一骨架子集 /
  变体维度同构 / doNotInvent 显式从属声明），每族 mergeBasis 写明依据，不按名字猜。
- 实现层合并（导航族端到端切片）：tools/gen-family-impl.mjs 从 5 端模板生成
  TopMenu / SideMenu / MixedNavigation 共 15 文件，参数 direction=top|side|mixed；
  三份 CSS md5 完全相同 = 一份样式表服务三个组件。
- 新增 tools/gen-families.mjs、tools/gen-family-impl.mjs、tools/verify-families.mjs、
  tools/lib/family-model.mjs、tools/lib/family-impl/nav-menu/*.tpl。

【同时清掉此前已完成但未提交的批次】
生成物（data.json / data.js / site/sources / site/components 薄壳 / sitemap.xml / tests 报告）
跨阶段交织，无法拆成互相自洽的多个提交，故按既有批量风格合并提交：
- Package：三端可 import（S5-P18）+ 发布到私有 npm 源
- Docs site：导航语言改下拉（S5-P19）、详情页代码块默认展开、中英切换完整性
- Security：生产部署链审计修复（2026-09-19）+ 线上部署
- Theme modes 日间/夜间/自动；S1-P4 data.js 瘦身；S2-P5 暗色；S2-P6 跨端一致性；
  S2-P7 行为断言；S2-P9 FAQ；S3-P8 RTL；S3-P9 契约缺口解释层；S4-P12 发布流程
- 补入 tools/pack-deploy.mjs、run-site-smoke.mjs、verify-*.mjs，.dockerignore、
  安全审计修复与待决策项.md

【验收】
- node tools/verify-families.mjs → OK: 族层端到端一致（13 族 / 44 成员 / 79 组件不变 / 395 文件不变）
- node tools/verify-cross-platform.mjs → 79/79 identical（HEAD 基线 high 44）
- node tools/run-regression.mjs → 100%（79/79 页，1017/1017 断言，N/A 34），连跑 8 次一致，0 超时
- 逐页实测：topmenu / sidemenu / mixednavigation 各 13/13，帧内 direction 参数正确，0 JS 错误
- 零运行时依赖 OK；build-site.ps1 ASCII-only OK

【未纳入】site/components/<slug>/ 平台薄壳 316 个 —— 历史从未跟踪且属构建产物，保持现状。

.github/workflows/deploy-pages.yml

@@ -1,15 +1,19 @@
 name: Deploy to GitHub Pages
+
 on:
   push:
     branches: [main]
   workflow_dispatch:
+
 permissions:
   contents: read
   pages: write
   id-token: write
+
 concurrency:
   group: pages
   cancel-in-progress: true
+
 jobs:
   deploy:
     environment:
@@ -17,10 +21,54 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/configure-pages@v5
-      - uses: actions/upload-pages-artifact@v3
+      - name: Checkout
+        uses: actions/checkout@v4
         with:
-          path: .
+          persist-credentials: false
+
+      - name: Configure Pages
+        uses: actions/configure-pages@v5
+
+      - name: Assemble minimal Pages package
+        shell: bash
+        run: |
+          set -euo pipefail
+          rm -rf site-dist
+          mkdir -p site-dist/site site-dist/frameworks site-dist/.design_library/aurora-admin
+
+          cp index.html sitemap.xml site-dist/
+          cp -a site/. site-dist/site/
+          cp -a frameworks/. site-dist/frameworks/
+
+          # The live documentation reads these token, aggregate CSS and contract assets.
+          cp .design_library/aurora-admin/colors_and_type.css site-dist/.design_library/aurora-admin/
+          cp .design_library/aurora-admin/components.css site-dist/.design_library/aurora-admin/
+          cp .design_library/aurora-admin/css.json site-dist/.design_library/aurora-admin/
+          cp -a .design_library/aurora-admin/components site-dist/.design_library/aurora-admin/
+
+          # Pages excludes repository-only tests, raw specifications, metadata and reports.
+          rm -rf site-dist/.git site-dist/.github site-dist/.design_library/aurora-admin/specs \
+            site-dist/.design_library/aurora-admin/agent-reports site-dist/.design_library/aurora-admin/preview \
+            site-dist/.design_library/aurora-admin/ui_kits site-dist/tests
+
+          # Exception: the homepage pass-rate card fetches ../tests/report.json. Without this
+          # single file the card silently renders nothing (the fetch 404s and is swallowed),
+          # so it must be copied back after the tests/ purge above.
+          mkdir -p site-dist/tests
+          cp tests/report.json site-dist/tests/report.json
+
+          find site-dist -type f \( -name '*.ps1' -o -name '*.yml' -o -name '*.yaml' \) -delete
+          test -f site-dist/site/index.html
+          test -f site-dist/site/data.json
+          test -f site-dist/site/tokens/tokens.css
+          test -f site-dist/tests/report.json
+          test "$(find site-dist/site/components -maxdepth 1 -name '*.html' | wc -l)" -eq 79
+          du -sh site-dist
+
+      - name: Upload Pages artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: site-dist
+
       - id: deployment
         uses: actions/deploy-pages@v4

.github/workflows/regression.yml

@@ -1,12 +1,7 @@
 name: Regression
 
 # 每次 push / PR 自动跑回归。
-# 目标：让质量不再依赖「人工记得跑」—— 这是 ROADMAP S1-P3 的核心价值。
-#
-# 说明：
-#  - playwright 是 devDependency（CI 专用工具），运行时依然零依赖。
-#  - dev-server 在 Ubuntu 上可正常跑（Node 脚本，跨平台）。
-#  - 失败时仍上传报告，便于排查。
+# 所有检查都在 Node 20 上执行；playwright 仅作为 CI 开发依赖。
 
 on:
   push:
@@ -15,6 +10,9 @@ on:
     branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   regression:
     runs-on: ubuntu-latest
@@ -23,6 +21,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup Node
         uses: actions/setup-node@v4
@@ -33,15 +33,20 @@ jobs:
         uses: actions/cache@v4
         with:
           path: ~/.cache/ms-playwright
-          key: ${{ runner.os }}-playwright-${{ hashFiles('package.json') }}
+          key: ${{ runner.os }}-playwright-${{ hashFiles('package.json', 'package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-playwright-
 
       - name: Install dependencies
-        run: npm ci || npm install
+        run: npm ci
 
       - name: Install playwright chromium
-        run: npx playwright install --with-deps chromium
+        run: npx --no-install playwright install --with-deps chromium
+
+      # npm run verify:nav 的断言依赖字体度量（7 条链接的文字宽度决定顶栏装不装得下）。
+      # 缺 CJK 字体时中文会退化成豆腐块或拉丁回退，宽度随之改变 → 断言假失败。
+      - name: Install CJK fonts
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq fonts-noto-cjk
 
       - name: Verify zero runtime dependencies
         run: |
@@ -58,7 +63,6 @@ jobs:
       - name: Start dev server
         run: |
           node site/dev-server.js &
-          # 等服务就绪（最多 15 秒）
           for i in $(seq 1 30); do
             if curl -sf http://127.0.0.1:3311/site/data.json > /dev/null; then
               echo "server ready after ${i} attempt(s)"
@@ -69,9 +73,30 @@ jobs:
           echo "FAIL: dev-server 未在 15 秒内就绪"
           exit 1
 
+      - name: Verify i18n
+        run: node tools/verify-i18n.mjs
+
+      - name: Verify site routing
+        run: node tools/verify-site-routing.mjs
+
+      - name: Verify cross-platform structure
+        run: node tools/verify-cross-platform.mjs
+
+      - name: Verify theme modes
+        run: node tools/verify-theme.mjs
+
       - name: Run regression
         run: node tools/run-regression.mjs
 
+      - name: Smoke test site
+        run: npm run smoke:site
+
+      # 顶栏窄屏折叠（≤1366px 汉堡 + 抽屉）：18 个宽度 × 中英双语 + 抽屉交互，约 35 秒。
+      # 必须在浏览器里跑 —— 元素"可见"不等于"点得到"：遮罩层叠、visibility 过渡
+      # 都会让点击静默失效，而矩形与可见性断言全都会通过（改动前实测踩中两个）。
+      - name: Verify responsive nav
+        run: npm run verify:nav
+
       - name: Upload report
         uses: actions/upload-artifact@v4
         if: always()
@@ -80,6 +105,7 @@ jobs:
           path: |
             tests/report.json
             tests/report-junit.xml
+            tests/cross-platform-report.json
           retention-days: 30
 
       - name: Publish test summary
@@ -98,5 +124,5 @@ jobs:
             console.log('| N/A | ' + (a.na || 0) + ' |');
             console.log('| 页面全通过 | ' + r.pagesAllPass + '/' + r.pages + ' |');
             console.log('| 超时 | ' + ((r.timedOut || []).length) + ' |');
-            " >> \$GITHUB_STEP_SUMMARY
+            " >> "$GITHUB_STEP_SUMMARY"
           fi