fix(authz): require email approval for native layout signing

server-tools/lake-lamp-authz/server.js

@@ -1115,6 +1115,12 @@ function createApp(options = {}) {
           resource,
         );
         if (!verified.ok) return json(res, 403, failure(verified.reason));
+        if (verified.session.approvalChannel !== "email") {
+          return json(res, 403, failure(
+            "ghdr_email_approval_required",
+            "企业原生布局必须由京东主控的预登记邮箱完成本次批准。",
+          ));
+        }
         const map = mapGate.read(target);
         if (!mapGate.verify(token, target, map.hash).ok) {
           return json(res, 423, failure("map_ack_required", "先读取并确认导航图。", {