fix(plugin-health): make the command able to read what the scanner found

Dogfooding `/config-audit plugin-health` against a fasit registered before the
run: 11 of 12 predictions confirmed, 1 refuted with evidence, 0 deviations.
The command's default path could not produce the report it documents.

M-BUG-21 (third arm): the argument loop ended in
`else if (!args[i].startsWith('-')) targetPath = args[i]` with no unknown-flag
branch, so `--output-file /tmp/x.json` was dropped and its value became the scan
target. Worse than in drift-cli: a non-existent path discovers no plugins, so the
scanner answered "No plugins found" (info) with exit 0 — a reassuring answer, not
an error. Unknown options and a value-less `--output-file` now exit 3.

M-BUG-33: the scanner had no `--output-file` and its default-mode report goes to
stderr, which `commands/plugin-health.md` discards with `2>/dev/null` before
telling the agent to read stdout. Zero bytes captured.

M-BUG-34: per-plugin rows and the grade formula never left `scan()` — the only
grade code, `formatPluginHealthReport`, had no caller — and cross-plugin findings
were flattened behind a `category` they share with per-plugin findings. The
mandated table and Cross-Plugin section were unbuildable, so the command had to
fabricate them. `scanDetailed()` now returns them; `scan()`'s frozen v5.0.0
envelope is unchanged by construction.

M-BUG-35: `.claude-plugin/marketplace.json` was flagged as an unknown file. It is
the documented catalog location, and `"source": "./"` makes the repo root its own
plugin, so one `.claude-plugin/` legitimately holds both.

Also: `commands/posture.md` ran both optional scanners in default mode under
`2>/dev/null` and read stdout — the same class as feature-gap.md:133 in the fix
chunk. A CLI-side flag fix does not close its callers.

Tests 1420 -> 1432, red first. Frozen v5.0.0 snapshots untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XhhZ8zg1amR7YCAPqiZWdt

tests/commands/group-b-shape.test.mjs

@@ -132,3 +132,29 @@ test('status.md: preserves current_phase machine field and adds humanized phase
     `status.md must include at least 3 humanized phase labels; found ${present.length}: ${present.join(', ')}`,
   );
 });
+
+// ---------------------------------------------------------------------------
+// Økt #46 — ux-rules rule 2 for the plugin-health scanner.
+//
+// plugin-health.md passed the humanized-field assertion above while the data it
+// names was unreachable: the scanner had no --output-file, and its default-mode
+// report went to stderr, which the command discards with `2>/dev/null`. A .md
+// contract test that only greps for prose cannot catch that — these assert the
+// plumbing that makes the prose true.
+// ---------------------------------------------------------------------------
+
+test('plugin-health.md invokes the scanner with --output-file (ux-rules rule 2)', async () => {
+  const content = await readCommand('plugin-health.md');
+  const call = content.split('\n').find(l => l.includes('plugin-health-scanner.mjs'));
+  assert.ok(call, 'plugin-health.md must invoke plugin-health-scanner.mjs');
+  assert.match(call, /--output-file/, 'scanner call must write to a file, not stdout/stderr');
+});
+
+test('posture.md invokes the plugin-health and drift scanners with --output-file', async () => {
+  const content = await readCommand('posture.md');
+  for (const scanner of ['plugin-health-scanner.mjs', 'drift-cli.mjs']) {
+    const call = content.split('\n').find(l => l.includes(`scanners/${scanner}`));
+    assert.ok(call, `posture.md must invoke ${scanner}`);
+    assert.match(call, /--output-file/, `${scanner} call in posture.md discards its output`);
+  }
+});