feat(web): enforce Traditional Chinese security wording

scripts/security/security-mirror-progress-guard.py

@@ -40,6 +40,11 @@ def assert_text_contains(label: str, text: str, expected: str) -> None:
         raise SystemExit(f"BLOCKED {label}: missing {expected!r}")
 
 
+def assert_text_not_contains(label: str, text: str, forbidden: str) -> None:
+    if forbidden in text:
+        raise SystemExit(f"BLOCKED {label}: forbidden {forbidden!r}")
+
+
 def validate(root: Path) -> None:
     security_dir = root / "docs" / "security"
 
@@ -282,6 +287,7 @@ def validate(root: Path) -> None:
         "s2_67_awooop_home_github_primary_readiness_summary",
         "s2_68_awooop_tenants_github_primary_readiness_scope",
         "s2_69_awooop_runs_github_primary_readiness_boundary",
+        "s2_70_traditional_chinese_security_surface_wording_guard",
     ]
     assert_equal(
         "progress_delta_ledger.delta_ids",
@@ -396,6 +402,51 @@ def validate(root: Path) -> None:
         [item["action_id"] for item in rollup["next_safe_actions"] if isinstance(item, dict)],
         "show_awooop_runs_github_primary_readiness_boundary",
     )
+    assert_contains(
+        "rollup.next_safe_actions.action_ids",
+        [item["action_id"] for item in rollup["next_safe_actions"] if isinstance(item, dict)],
+        "enforce_traditional_chinese_security_surface_wording",
+    )
+
+    zh_security_surface_text = json.dumps(
+        {
+            "iwooos": web_messages_zh["iwooos"],
+            "awooop": web_messages_zh["awooop"],
+        },
+        ensure_ascii=False,
+    )
+    for forbidden in [
+        "Information Security Mesh",
+        "Mirror-only / Observe-first",
+        "Exposure Posture",
+        "Source-control Supply Chain",
+        "Owner response missing",
+        "GitHub Primary Readiness",
+        "Active runtime gates",
+        "Candidate repos",
+        "In-scope repos",
+        "Owner responses",
+        "Owner response",
+        "Workflow inventory",
+        "Security runs",
+        "Run visibility",
+        "Run State",
+        "Readiness evidence refs",
+        "Owner response lanes",
+        "Source-control 邊界",
+        "Ready for mirror",
+        "Primary ready",
+        "AwoooP Operator Console",
+        "Control Plane",
+        "Shadow First",
+        "Operator Runs",
+        "Run Detail",
+        "Project / Agent",
+        "Incident ID",
+        "Incident Evidence",
+        "Run Timeline",
+    ]:
+        assert_text_not_contains("web_messages.zh-TW.security_surface_wording", zh_security_surface_text, forbidden)
 
     assert_equal("rollout_policy.schema_version", rollout_policy["schema_version"], "security_rollout_policy_v1")
     assert_equal("rollout_policy.default_mode", rollout_policy["default_mode"], "observe")