#1177 Rewrite links, tokens, and template variables in a Markdown file support entry

[williamthorsen]

What

Fixes an issue where a Markdown file placed directly in a package's skills directory, rather than in a subdirectory, was installed with its relative links pointing nowhere and its placeholder tokens left as literal text. Such a file now fails when it carries an unsupported rulebook reference.

Why

A package following the producer contract may ship a loose Markdown file under skills/, and until now that file reached the harness home unusable: its links led nowhere and its tokens read as literal text, while the same file one directory deeper worked. The gap was invisible in the library's own content, which ships no such file, so it would have surfaced first on a third-party package.

Details

🐛 Bug fixes

• renderSupportEntry sent a Markdown file through include expansion, the guidance-hook strip, the anchor gate, and the tool-name rewrite alone, skipping link rewriting, invocation-token rewriting, and template expansion. Both branches now render through the same chain, so an entry's shape decides how it is walked and never which rewrites apply to the Markdown it holds. The narrow chain was validate-shaped, inherited from a checking pass that cared only about the transforms that can fail; install adopted it later and shipped its output.
• The unification reaches both delivery paths, the library's install and a declared source's sync, because each already routed through the shared render.

♻️ Refactoring

• renderMarkdown takes one fileRelPath in place of the relPath and slug pair it composed into a link-anchor path at render time. The single parameter is expressible by a caller with no slug/relPath split, which is what lets a Markdown file entry share the render.

🧪 Tests

• Added coverage at each of the three surfaces: the render itself, a declared source's support delivery, and the installed file in the harness home.
• Corrected two existing cases that paired a source path inside _data/ with a destination name of _data, a combination no caller produces and one that would have masked a defect now that the destination name anchors link resolution.
• Both suites in the skill-transform tests build their deploy context from a single module-scoped buildContext.

Closes #1177

[github-actions]

Dependency audit

Production dependency audit passed.