내부 builder 인증과 실행 허용 목록 및 자원 경계를 적용한다

scripts/check.sh

@@ -10,7 +10,7 @@ if [ ! -f "$env_file" ]; then
   exit 66
 fi
 
-secret_file_keys='IMAGE_UPLOAD_CORE2026_SECRET_FILE IMAGE_SYNC_CORE2026_SECRET_FILE'
+secret_file_keys='IMAGE_UPLOAD_CORE2026_SECRET_FILE IMAGE_SYNC_CORE2026_SECRET_FILE RELEASE_BUILDER_TOKEN_FILE'
 if [ "$(sed -n 's/^WEB_PUSH_ENABLED=//p' "$env_file" | tail -n 1)" = true ]; then
   secret_file_keys="$secret_file_keys WEB_PUSH_VAPID_PRIVATE_KEY_FILE"
 fi
@@ -33,6 +33,10 @@ for key in $secret_file_keys; do
     echo "$key must not use the tracked example placeholder." >&2
     exit 66
   fi
+  if [ "$key" = RELEASE_BUILDER_TOKEN_FILE ] && [ "$(stat -c %a "$secret_path")" != 600 ]; then
+    echo 'RELEASE_BUILDER_TOKEN_FILE must have mode 0600.' >&2
+    exit 66
+  fi
 done
 
 docker run --rm --network=none --memory=128m --memory-swap=128m --cpus=1 --pids-limit=64 --env-file "$env_file" \