fix(corporate-bank-account-payment-order): 恢复制单表头富文本并标识行号

.trellis/spec/hyb-oa/security-privacy.md

@@ -71,6 +71,10 @@
   bank template's column widths, row heights, fonts, fills, borders or
   alignment. The asset contains headers and formatted blank rows only, and its
   SHA-256 is verified before every fill.
+- BIFF8 rich-text runs are part of the template contract. Open the template
+  with `formatting_info=True`, copy every source font property, and explicitly
+  call `write_rich_text`; `xlutils.filter` does not preserve those runs by
+  default. Never replace this with a hard-coded "red" font approximation.
 - Node owns authorization, snapshot decryption, blockers, ordering, serials,
   amounts, audit and export counters. Python only copies the fixed template and
   fills the already validated 15-cell rows. Full accounts travel only on child
@@ -126,6 +130,10 @@
   amounts and deterministic row order. Compare visual signatures for column
   widths, row heights, font/bold, fill, border, alignment and wrapped text;
   include a row beyond the three preformatted template rows.
+- Compare rich-text segments semantically, including start offsets and complete
+  font properties. Required headers must assert the first `*` uses the source
+  red font and all remaining text uses the source black font; whole-cell style
+  equality is insufficient.
 - Negative tests cover missing Python/dependencies, template hash drift, child
   failure and a child that echoes the synthetic input to stderr; exposed errors
   and logs must not contain the account or original row payload.