feat(portal): add service drawers and employee portal preview

www/tools/phase10-artifact.test.mjs

@@ -129,3 +129,14 @@ test('artifact digest is deterministic for unchanged files', async () => {
   assert.equal(first.artifactSha256, second.artifactSha256);
   assert.equal(first.artifactFiles, second.artifactFiles);
 });
+
+test('release verification rejects private portal resources and encrypted payloads', async () => {
+  const root = await fixture('staging');
+  await fs.mkdir(path.join(root, 'private/employee-portal'), { recursive: true });
+  await fs.writeFile(path.join(root, 'private/employee-portal/manifest.json'), '{}');
+  await fs.appendFile(path.join(root, 'index.html'), '<script type="application/json" data-portal-payload>{"streams":[]}</script>');
+  const result = await verifyArtifact(root, 'staging');
+  assert.equal(result.passed, false);
+  assert.ok(result.errors.some((error) => error.includes('private portal ciphertext')));
+  assert.ok(result.errors.some((error) => error.includes('private/legacy')));
+});