Guard the supertool rule's two copies against silent drift (#577)

[fdaviddpt]

The supertool rule body exists twice: the tracked .claude/jit-context/tools/01-oss/supertool-required.md, which this repository's own sessions read, and TOOLS_SUPERTOOL in scripts/oss_rules.py, which is what gets written into every scaffolded repository. Nothing compared them, which is how #570's requires: paragraph went stale in both at once and was only caught because one lane happened to hold both files.

Closes #577

What changed

• tests/test_supertool_rule_sync_577.py: reads both bodies and asserts they match, normalised for line endings and trailing whitespace only (CI runs Windows, so a checkout-level CRLF must not read as drift). Includes a control pair driven against synthetic bodies (an edit made identically to both copies still matches; an edit to exactly one is caught; a CRLF-only difference is not read as drift), plus two positive-control tests pinning that neither body is empty or trivially short -- a sameness assertion also passes when both sides are empty, so the fixture needed that half too.
• CLAUDE.md: a new bullet under Traps that cost time here documenting the two-copy arrangement, the #524's requires: prose is stale: claude-jit-context 0.6.0 ships the reader, and the rule still tells readers nothing does #570 incident, and why a comparison test was chosen over deriving one copy from the other at import/build time (a real option, weighed and declined for this narrow pair -- it would change how the rule layer is assembled, which is a bigger decision than one file needed).
• changelog.d/577.fixed.md.

Judgment calls, as asked in the brief

1. Byte-identical vs normalised: normalised, for line endings and trailing whitespace only -- nothing else. CI's Windows legs make byte-identical the wrong bar.
2. May TOOLS_SUPERTOOL differ at the frontmatter: no -- measured, not assumed. The two bodies were byte-identical including frontmatter at the moment this test was written, so there is no established reason for a carve-out; if one becomes real, the test is the place to record it.
3. Test vs derivation: test. Derivation removes the class but changes how the rule layer is assembled for the sake of a single pair; a comparison test costs one file and answers the same question without touching rules()/install().

A correction to the issue's own reasoning

The issue states that tests/test_content_invariants.py "holds one narrow fact about the pair (#250)" -- checked directly (grep -n TOOLS_SUPERTOOL tests/test_content_invariants.py and the same for supertool-required, both empty): that #250 check is about a completely different pair (agents/developer.md and skills/manager/SKILL.md) and never mentions either file here. This pair had zero prior coverage, not narrow coverage. The new test's docstring says so directly rather than repeating the issue's citation. Below-bar, not filed separately: it is a one-word correction to a citation in an issue already closed by this PR, with no other caller -- below-bar: a stale citation the issue itself carried, with no code effect and no other reader once this PR merges.

Tests

Red: 1 failed, 5 passed (bodies diverged after a synthetic edit to the .md copy only). Green: 6 passed (edit reverted). Full suite: 3770 passed, 7 skipped in 1604.74s, 89.35% coverage -- all pre-existing skips, none introduced by this change.

Review

Two spawns, both stated findings/no-findings directly (no returned-nothing). Explore found one real issue: the first draft of the new test's docstring repeated the issue's own inaccurate #250 citation -- fixed in a follow-up commit. oss:auditor reported NO FINDINGS across all four classes plus the platform band.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com