fix: 对照《财务处Skill002》验收整改并升版 v1.0.2

- 状态标签：C3 触发且 D 未判 → 待补录，优先级对齐需求 §6.2
- broadcast-monthly 逐项目增量 emit，任务中心可见进行中进度
- progress_reports 回填 project_id；新增 items_json/updated_at；旧库重建式安全迁移（含回归测试）
- 简报：TITLE 转义防注入、章节对齐 §10（独立「暂付款/结题提醒」）、页脚逐字统一
- 金标准测试 +17：±10%/20% 阈值恰界、C2 钳位、N2 反例、C3 逐字段、HTML 转义、async+cron 定位守护、迁移回归
- 文档 v1.1（开发文档 + REQUIREMENTS）：ERROR:<CODE> <message>、reports_brief、--all-status、skill-detail 表外挂载、C1 level=warn
- 落盘验收报告 acceptance-reports/20260924-105401-acceptance.md（338 测试全绿）
- 版本 1.0.1 → 1.0.2（constants / SKILL.md / CHANGELOG 三处对齐）

tests/test_actions_manifest.py

@@ -598,6 +598,18 @@ class TestActionsManifest(unittest.TestCase):
                     msg=f"{action['id']} must not be auto-placed on toolbar",
                 )
 
+    def test_broadcast_monthly_is_async_with_cron_and_agent(self) -> None:
+        """定位表（开发文档 §9 / REQUIREMENTS §0.1）：月度播报必须 async + agent + cron。"""
+        manifest = _load_actions_manifest()
+        monthly = next((a for a in manifest["actions"] if a["id"] == "broadcast-monthly"), None)
+        self.assertIsNotNone(monthly, msg="broadcast-monthly action missing from manifest")
+        self.assertEqual(monthly.get("executionProfile"), "async")
+        placements = set(monthly.get("placements") or [])
+        self.assertIn("cron", placements, msg="broadcast-monthly must be placed on cron (每月 5 号定时)")
+        self.assertIn("agent", placements, msg="broadcast-monthly must be reachable from conversation")
+        entry = monthly.get("entrypoint") or {}
+        self.assertEqual(entry.get("command"), "broadcast-monthly")
+
     def test_actions_md_documents_strict_vs_host_boundary(self) -> None:
         path = os.path.join(get_skill_root(), "references", "ACTIONS.md")
         with open(path, encoding="utf-8") as f: