feat(governance): pin selective upstream import contract

tests/test_report_orchestrator_reader_contract.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 
 import hashlib
 import json
+import re
 from pathlib import Path
 
 from scripts.report_orchestrator import render_reader_report
@@ -42,9 +43,11 @@ def test_upstream_skill_snapshot_matches_manifest_and_commercial_root_remains_ro
     root_skill = (ROOT / "SKILL.md").read_text(encoding="utf-8")
     linked_skill = ROOT / "skills/jyotish-vedic-astrology/SKILL.md"
 
-    assert hashlib.sha256(snapshot.read_bytes()).hexdigest() == manifest["skill_sha256"]
-    assert manifest["source_mode"] == "snapshot"
-    assert manifest["source_commit"] is None
+    snapshot_hash = hashlib.sha256(snapshot.read_bytes()).hexdigest()
+    assert snapshot_hash == manifest.get("source_skill_sha256", manifest["skill_sha256"])
+    assert manifest["source_mode"] == "archive"
+    assert re.fullmatch(r"[0-9a-f]{40}", manifest["source_commit"])
+    assert re.fullmatch(r"[0-9a-f]{64}", manifest["source_tree_sha256"])
     assert linked_skill.resolve() == (ROOT / "SKILL.md").resolve()
     assert "商业运行时路由（最高优先级）" in root_skill
     assert "references/upstream/yinduzhanxing/SKILL.md" in root_skill