fix(ci): unbreak self-test on quirk-def file + auto-track registry count

.github/actions/bitbox-audit/action.yml

@@ -11,7 +11,10 @@ inputs:
     description: >
       Git ref of DFXswiss/bitbox-testkit to install. Pin to a
       tag (v0.2.0) for reproducibility; use 'main' during testkit
-      development to track the bleeding edge.
+      development to track the bleeding edge. The sentinel value
+      'local' is reserved for the testkit's own self-test workflow
+      and builds the CLI from the checked-out source — consumers
+      should never set it.
     required: false
     default: v0.2.0
   firmware:
@@ -117,9 +120,23 @@ runs:
       env:
         GOPROXY: 'direct'
         GOSUMDB: 'off'
+        TESTKIT_REF: ${{ inputs.testkit-ref }}
+        ACTION_PATH: ${{ github.action_path }}
       run: |
-        go install "github.com/DFXswiss/bitbox-testkit/go/cmd/bitbox-audit@${{ inputs.testkit-ref }}"
-        go install "github.com/DFXswiss/bitbox-testkit/go/cmd/bitbox-audit-explain@${{ inputs.testkit-ref }}"
+        set -euo pipefail
+        if [ "$TESTKIT_REF" = "local" ]; then
+          # Self-test path: build from the checked-out testkit source.
+          # PR builds run as `github.sha`, the synthetic merge commit,
+          # which is not in `refs/heads/*` and therefore unreachable to
+          # `go install`. The local build sidesteps that and tests the
+          # exact code in the PR.
+          src="$(cd "$ACTION_PATH/../../.." && pwd)/go"
+          echo "::notice::testkit-ref=local — building CLI from $src"
+          (cd "$src" && go install ./cmd/bitbox-audit ./cmd/bitbox-audit-explain)
+        else
+          go install "github.com/DFXswiss/bitbox-testkit/go/cmd/bitbox-audit@$TESTKIT_REF"
+          go install "github.com/DFXswiss/bitbox-testkit/go/cmd/bitbox-audit-explain@$TESTKIT_REF"
+        fi
 
     - name: Run BitBox-specific Jest tests
       if: inputs.run-jest == 'true' && steps.deps.outcome == 'success'

.github/workflows/test.yml

@@ -112,7 +112,10 @@ jobs:
       - name: run composite action against this repo
         uses: ./.github/actions/bitbox-audit
         with:
-          testkit-ref: ${{ github.sha }}
+          # `local` builds the CLI from the checked-out source. We can't
+          # use `${{ github.sha }}` because PR builds resolve that to a
+          # synthetic merge commit that's not reachable to `go install`.
+          testkit-ref: local
           run-jest: 'false'
           comment-on-pr: 'false'
           wasm-hash-check: 'false'

go/bitbox/simulator/scenarios.go

@@ -1,5 +1,9 @@
 //go:build simulator
 
+// audit-skip-file: this file is the simulator scenario library. The umlaut
+// payloads exist precisely to exercise quirk E1 (non-ASCII rejection); they
+// are test data, not production strings to flag.
+
 package simulator
 
 import (

ts/test/quirks.test.ts

@@ -1,8 +1,12 @@
 import { Registry, subset, firmwareApplies } from '../src/quirks/index.js';
+// Plain import (no `with { type: 'json' }`) keeps the test runnable under
+// ts-jest, matching the loader's import style — see loader.ts for context.
+import rawJson from '../src/quirks/quirks.json';
 
 describe('quirks registry', () => {
-  it('loads all 30 quirks from quirks.json', () => {
-    expect(Registry.length).toBe(30);
+  it('loads every quirk from quirks.json', () => {
+    expect(Registry.length).toBeGreaterThan(0);
+    expect(Registry.length).toBe((rawJson as { quirks: unknown[] }).quirks.length);
   });
 
   it('has no duplicate IDs', () => {