fix(fix): validate the arguments, back up renames, and verify the scope it fixed

Dogfooding `/config-audit fix` against a throwaway repo copy. All eight
predictions registered in the fasit before the run were confirmed, and three
further defects surfaced that were not predicted.

- M-BUG-21, third arm: the argument loop ended in `!arg.startsWith('-') =>
  targetPath`, so an unknown flag was dropped and its value became the target.
  In `fix` that is the WRITE target under `--apply`. Unknown options and a
  value-less `--output-file` now exit 3.
- `--dry-run` was documented in the command's argument-hint and never
  implemented; `--output-file` did not exist, so `commands/fix.md` told the
  agent to Read a file nothing produced. Both now exist.
- M-BUG-31: `file-rename` was excluded from the backup set, so a renamed rule
  file had no backup entry while the command promised one and returned a
  backupId that could not restore it.
- M-BUG-32: `verifyFixes` hardcoded `includeGlobal: false`, so after a
  `--global` run every untouched user-scope finding was reported as verified.
  Reproduced against an unmodified ~/.claude/CLAUDE.md.
- M-BUG-29: a rename was applied before other fixes on the same file, which
  then failed with ENOENT while the run still exited 0. Renames sort last.
- M-BUG-30: `severityOrder[s] || 4` maps critical (0) to 4, so critical fixes
  sorted last. The old test used the same falsy fallback and agreed with the
  bug. Now `?? 4`.
- A failed fix exits 2 instead of 0, matching the other scanners' convention.

Frozen tests/snapshots/v5.0.0/ untouched; --json/--raw stdout byte-identical.
Suite 1420/0 (+10).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YJ3MCDCnyw7wZSPnUXVhYS

CHANGELOG.md

@@ -31,7 +31,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   running under `2>/dev/null` can still see it. `--json`/`--raw` stdout stays v5.0.0-shaped and the
   frozen `drift.json` snapshot is untouched.
 
-**1410** tests (+12). No count change (scanners **16**, agents **7**, commands **21**, hooks **4**).
+- **`M-BUG-21` (third arm) — `fix-cli.mjs` had the same unvalidated argument loop, where it moves the
+  *write* target.** An unrecognised flag was dropped and its value became the scan target, so
+  `fix-cli.mjs <repo> --output-file /tmp/x.json` silently audited `/tmp/x.json`; with `--apply` the
+  same slip relocates what gets written. Unknown options and value-less `--output-file` now exit `3`.
+  `--dry-run` — documented in `commands/fix.md`'s `argument-hint` but never implemented — is now
+  accepted instead of silently dropped, and `--output-file` writes the fix payload to disk so
+  `commands/fix.md` can read a file rather than parse stdout it runs under `2>/dev/null`.
+- **`M-BUG-31` — `fix` promised a mandatory backup it did not always take.** `fix-cli.mjs` excluded
+  `file-rename` from the backup set, so a rule file whose only defect was its extension was renamed
+  with **no** backup entry — while the command told the user "every fix creates a backup first" and
+  handed back a `backupId` that could not restore it. The source file is now backed up like any other.
+- **`M-BUG-32` — verification re-scanned a different scope than the fix run.** `verifyFixes` hardcoded
+  `includeGlobal: false`. After a `--global` run every user-scope finding fell out of the re-scan and
+  was therefore counted as *verified*: a clean "fixed" report for files nothing had touched
+  (reproduced against an untouched `~/.claude/CLAUDE.md`). It now inherits the run's scope, and
+  `commands/fix.md` passes `--global` to every step instead of only the display scan.
+- **`M-BUG-29` — two fixes on one file were applied in an order that guaranteed failure.** A rule file
+  with both `globs:` and a non-`.md` extension had the rename applied first; the frontmatter fix then
+  failed with `ENOENT`. Renames now sort after every other fix.
+- **`M-BUG-30` — critical fixes sorted last.** `severityOrder[s] || 4` maps `critical` (weight `0`) to
+  `4`, the opposite of the documented "critical first" contract. The old test used the same falsy
+  fallback, so it agreed with the bug. Now `?? 4`.
+- **A failed fix no longer exits `0`.** `fix-cli.mjs` returns `2` when any planned fix failed, matching
+  the `0/1/2 = PASS/WARNING/FAIL`, `3 = error` convention the other scanners follow.
+
+**1420** tests (+10). No count change (scanners **16**, agents **7**, commands **21**, hooks **4**).
 
 ## [5.13.0] - 2026-07-31