fix: decouple known-customer & free-shipping fulfillment tests from sample behavior

[vishkaty]

Description

The known-customer and free-shipping fulfillment tests
(fulfillment_test.py, the ~233–579 family) encode flower-shop sample
behavior as test-code literals: buyer identities and emails, stored-address
ids (addr_1/addr_2), option-id strings (std-ship), an
assertIn("Free", title), and free-shipping thresholds. None of these is a
requirement in the pinned 2026-04-08 spec — so the tests pass only against a
server that happens to reproduce the reference sample's choices, and can fail a
differently-but-conformantly-built server.

The circularity is direct: the Node reference hardcodes
isKnownCustomer = buyer?.email === "john.doe@example.com"
(samples/rest/nodejs/src/api/checkout.ts:203) — the reference was written to
the test, and the test to the reference.

None of the encoded literals is spec-grounded

• Option title — fulfillment.md (~L175–179) requires the title only to
  distinguish an option from its siblings and suffice for the buyer's
  decision; it says nothing about the word "Free".
• Stored-address injection / known-customer — no injection or
  known-customer language exists in fulfillment.md, checkout.md, or
  checkout-rest.md. Saved addresses are personalization that
  "upgrades the experience, it does not gate it" and is user-authenticated
  (identity-linking.md ~L29–33). (Consistent with the direction of merged
  fix: remove out-of-scope address persistence test #60, which removed an out-of-scope address-persistence test.)
• Option ids — the spec uses only illustrative ids ("standard"/"express");
  std-ship/exp-ship-* appear only in the sample servers.
• Free-shipping thresholds — no promotion/threshold text in the spec; this
  is server pricing policy (the flower shop's CSVs).

Change

The behaviors move out of test code and into optional fixtures, using the
suite's existing test_fixtures.json + skip-when-absent convention (the #71/#72
precedent; mirrors the existing valid_discount_code_2 keys). New keys:
known_customer, known_customer_without_address, free_shipping_min_subtotal,
free_shipping_item_sku (documented in the README fixtures section). When a
fixture is absent the relevant test skips rather than false-failing.

Assertions are rewritten to check the spec-relevant invariant, not the sample
literal:

• stored addresses located by content, with the server-assigned id read
  back from the response (no addr_1/addr_2);
• the zero-cost option found by total == 0, not by id or the word "Free";
• the free-shipping threshold derived from the fixture (threshold // price + 1);
• unknown-customer email and client destination ids randomized per run so they
  cannot collide with real data on an arbitrary server.

Soundness preserved

The relaxed tests still catch a genuinely non-conformant server — verified with
kill-tests on both the Python and Node references: a server that doesn't
store the declared address → fails; wrong address content (bad postal) → fails;
a declared eligible item or subtotal threshold left unhonored → fails; absent
fixtures → clean skips with no false pass. Full suite stays 17/17 on both
references; CI keeps full coverage because --fixture_config defaults to the
populated test_data/flower_shop/test_fixtures.json.

Scope

This covers the known-customer / free-shipping family. test_dynamic_fulfillment
still references the exp-ship-us/exp-ship-intl literals (same file, ~L236/269);
it's the same class but needs a second-destination fixture to decouple properly,
so I've left it as a deliberate follow-up rather than widen this PR. The
retained (now fixture-gated) address-id reuse check is likewise sample
behavior verified only when configured, not a spec MUST.

Category (Required)

• Conformance: Conformance test suite updates.