docs(skills): point the checklist-test extraction bullet at the Guardrails auth carve-out (#9843)

The section 4 extraction bullet told the runner to itemize reproduction and
mechanism into every extracted defect card, unconditionally. The skill's own
Guardrails clause carves authentication/authorization defects out of the
reproduction obligation, but the extraction bullet did not name it, so a runner
landing there alone saw no hint the carve-out exists. Adds one pointer clause,
following the precedent that gave RUNNER.md's corresponding paragraph the same
treatment. Not a third copy of the policy; the Guardrails clause is unchanged.

Zero net lines: the clause fits the bullet's existing final line at the file's
80-column wrap, so the shrink-only line ratchet stays at 232/232.


Claude-Session: https://claude.ai/code/session_01AeA3nU1B5Q2pgxqxgUrexd

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-warren

.claude/skills/checklist-test/SKILL.md

@@ -143,7 +143,7 @@ expected-fail 探针 —— 永不在真实缺陷上把条款打成绿。
   取为独立 issue:标题自含、复现与机制条目化、指回本 run issue 取全量证据;缺陷卡不
   挂 `qa-run`,正常进分诊首触。清单准确性发现与 fixture 缺口归波次锚卡(sweep 跟踪
   issue)收口,⛔ 不抽取;环境阻塞记录在案即可。逐条 `fail` 的四分法处置、收口评论的
-  机器行与抽取卡的溯源行见 §5。
+  机器行与抽取卡的溯源行见 §5。⛔ 认证 / 授权漏洞的抽取卡不写复现,见 Guardrails。
 - **完成判据** —— 一个区只有在**每一项都有判定**时才算跑完。跑不完的一轮照常立单:
   交出已有的判定,**外加一份点名未触达项的交接清单**,标题按上面的分数如实写。
   `not-run` 是诚实判定;在 11 项 not-run 之上写 `(FULL area)` 不是。