test(skill): the shipped consumption skill must pass the checker against its own payload

Red on f5a002e + 07df6a0, by design. The hand-filled skills/okf-consume
was refused by the checker it tells its reader to run, against the payload
shipped beside it:

  NOT conformant: 16 rules over 3 excerpts and 0 withheld entries, 1 findings
    bundle_mismatch: the skill declares no readable bundle identity, ...

No existing test stood the SHIPPED pair against each other: the checker
tests generate a skill in memory, so the file on disk was never read.

The second test holds the regeneration to the generator's bytes. `okf
skill` writes the bundle root and the skill path absolute when --out is
not under .claude/skills/, so the shipped copy is the generator's output
with the checkout prefix stripped, and the test is that strip.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_okf_consume.py

@@ -1178,6 +1178,38 @@ def test_the_shipped_example_payload_is_current_and_regenerates_byte_for_byte()
     assert shipped == regenerated
 
 
+def test_the_shipped_skill_passes_the_checker_against_its_own_payload() -> None:
+    # The pair this repository ships, read from disk and checked as it stands.
+    # The hand-filled copy that stood here until 2026-09-11 was refused against
+    # the payload beside it: "the skill declares no readable bundle identity".
+    # A skill that fails the check it tells its reader to run is the one
+    # artefact here that must not.
+    text = SKILL.read_text(encoding="utf-8")
+    payload = json.loads(
+        (SKILL.parent / "references" / "example-payload.json").read_text(encoding="utf-8")
+    )
+    report = okf_contract_check.check(text, payload)
+    assert report.findings == (), report.render()
+    assert report.rules_evaluated == len(okf_contract_check.RULES)
+
+
+def test_the_shipped_skill_is_the_generator_output_with_the_checkout_made_relative() -> None:
+    # `okf skill` writes the bundle root and its own path ABSOLUTE when --out is
+    # not under `.claude/skills/`, and `skills/okf-consume` is not. Shipped as
+    # generated, the file would name one checkout by absolute path and its two
+    # commands would run on one machine only. The single step after the
+    # generator strips the checkout prefix, and this test is that step, so the
+    # shipped bytes are the generator's bytes and nothing else.
+    generated, _ = okf_skill.render(
+        GOLDEN, out=SKILL.parent, question="Hva sier veiledningen om krav?"
+    )
+    prefix = f"{PROJECT_ROOT}/"
+    # The known-positive: the strip has something to strip, so the equality
+    # below is not a comparison of two texts that never carried the prefix.
+    assert prefix in generated
+    assert SKILL.read_text(encoding="utf-8") == generated.replace(prefix, "")
+
+
 @requires_k2
 def test_no_corpus_document_name_reaches_any_file_this_work_tracks() -> None:
     # CLAUDE.md's public-file rule. The pattern is DERIVED from the corpus's own