#27 fix: check out skills-vendor/ in the test job

[gregoryfoster]

Fixes #27.

tests/test_skills_hook.py::test_the_hook_the_symlink_points_at_actually_exists
dereferences the .claude/hooks/ symlink into skills-vendor/. actions/checkout
does not fetch submodules by default, so the link dangled on the runner and the test
could not pass in CI at all — main red since 7bf5988, 443 of 444.

Change

One key on the test job's checkout, plus the comment explaining why it is load-bearing.

• true, not recursive — neither submodule carries a .gitmodules, so recursion
  only adds a foreach pass to checkout and post-job cleanup.
• test job only — ruff never reads skills-vendor/; fetching two submodules to
  run a linter is cost for nothing.
• No auth change — both remotes are public HTTPS in .gitmodules. No token, no WIF,
  no wheelhouse impact.

Also widens the assertion message, which named only .skills/doctor.sh — developer-machine
advice that reads as nonsense on a runner.

Correcting the issue's evidence table

The third row is misattributed. Run 31117568515
(Merge #26) failed at Set up job with Failed to resolve action download info. Error: Service Unavailable — yesterday's Actions outage. It never reached checkout, let alone
pytest, and its lint job was cancelled at 15m rather than failed. Two runs share this
cause, not three; afb1f97 would have failed the same way, but that was never observed.

On the #22 v1.2 hold

Unaffected in both directions. The suspended refresh is a developer-machine SessionStart
hook CI never invokes, and checkout resolves the SHA pinned in this superproject rather
than upstream tip — so the pin the hold froze stays frozen.

Verification

• Local: 444 passed, 18 deselected (was 443 + 1 failed in CI).
• test green with 444, not 443 — the second assertion is os.access(HOOK, os.X_OK), and
  the target is mode 100755 in the skills index.
• lint untouched and still green.
• Runtime unchanged in practice: 2.0M + 2.2M working trees at depth 1, against a ~1m10s
  baseline.

Coupling accepted knowingly

The test job now depends on two third-party public repos being fetchable at checkout.
An upstream force-push that GCs a pinned SHA would fail the job at checkout — an error
that looks nothing like a test failure. Noted in the workflow comment so the next person
reading a checkout failure knows where to look.

🤖 Generated with Claude Code