skill: cross-task artifact pass with sha256 dual-channel verification

Core artifacts travel as an explicit manifest; coordinator triple-checks
(core report vs manifest vs recomputed hash) before cleanup, regression
rewrites files verbatim, recomputes sha256, stops on ARTIFACT-HASH-MISMATCH
and only then runs the same core code plus import-only regression tests.

cloud/tests/test_software_engineering_artifactpass.py

@@ -0,0 +1,37 @@
+"""software-engineering 技能的跨任务产物传递：轻量关键词断言。
+
+只断言正文与附录都含有产物传递的关键概念，不逐字背诵全文：
+产物清单文件名、sha256sum 实测、hash 不一致就停、核对通过标记、
+回归跑同一份代码而非自己写 fixture 猜契约。正文改了附录没同步时，
+本测试在附录部分就会失败（与 GitHub 保证测试同款口径）。
+"""
+
+import unittest
+from pathlib import Path
+
+SKILL = Path(__file__).resolve().parents[1] / "skills" / "software-engineering" / "SKILL.md"
+
+KEYWORDS = ("跨任务产物传递", "ARTIFACT_MANIFEST",
+            "sha256sum", "ARTIFACT-VERIFY-OK",
+            "ARTIFACT-HASH-MISMATCH", "三方核对",
+            "双通道", "fixture")
+
+
+class SoftwareEngineeringArtifactPassTestCase(unittest.TestCase):
+    def test_artifact_pass_in_body_and_appendix(self):
+        text = SKILL.read_text(encoding="utf-8")
+        main, sep, appendix = text.partition("## 附录：角色模板")
+        self.assertTrue(sep, "appendix marker missing")
+        for kw in KEYWORDS:
+            self.assertIn(kw, main, kw)
+            self.assertIn(kw, appendix, "appendix: " + kw)
+
+    def test_artifact_pass_forbids_fixture_substitution(self):
+        text = SKILL.read_text(encoding="utf-8")
+        main = text.partition("## 附录：角色模板")[0]
+        self.assertIn("绝不复制核心实现", main)
+        self.assertIn("跑同一份", main)
+
+
+if __name__ == "__main__":
+    unittest.main()