feat(knowledge): knowledge-refresh — living register, deterministic stale core + web poll (v5.7 Chunk 3)

The 'living' half of the v5.7 living knowledge base. Same hybrid split as the
optimization lens (Chunk 2b): a deterministic, byte-stable, unit-tested core +
a web/judgment command shell.

- scanners/lib/knowledge-refresh.mjs: pure assessFreshness(register,
  {referenceDate, staleAfterDays=90}) — age-based fresh/stale classification of
  source.verified; referenceDate injected (never reads the clock) → fully
  deterministic. 15 tests.
- scanners/knowledge-refresh-cli.mjs: -cli (NOT an orchestrated scanner →
  scanner count stays 15, suite byte-stable). Read-only — never writes the
  register, never hits the network. --reference-date/--stale-after/--dry-run,
  exit 0/1/3. 8 tests.
- commands/knowledge-refresh.md (opus): CLI stale-report → re-verify each stale
  entry by re-reading its source.url → poll CC changelog + Anthropic blog →
  apply ONLY human-approved writes, then re-validate the register. No unverified
  claim is ever auto-written (Verifiseringsplikt). Web-driven → not byte-stable.

No new agent, no new orchestrated scanner. Docs/badges: commands 19→20,
tests 1068→1091 (20 lib + 32 scanner test files). self-audit A/A, readmeCheck passed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -34,6 +34,7 @@ Analyzes and optimizes Claude Code configuration across three pillars:
 | `/config-audit drift` | Compare current config against saved baseline |
 | `/config-audit plugin-health` | Audit plugin structure, frontmatter, cross-plugin coherence |
 | `/config-audit whats-active` | Read-only inventory of plugins, skills, MCP, hooks, CLAUDE.md active for a repo (with token estimates) |
+| `/config-audit knowledge-refresh` | Keep the best-practices register fresh — deterministic stale check (sources older than ~90d) + web candidate poll (CC changelog + Anthropic blog); **human-approved writes only** (Verifiseringsplikt). The "living" half of the knowledge base. Web/judgment-driven, **not byte-stable** |
 | `/config-audit discover` | Run discovery phase only |
 | `/config-audit analyze` | Run analysis phase only |
 | `/config-audit interview` | Gather user preferences (opt-in) |
@@ -111,7 +112,7 @@ Default: auto-detects scope from git context. Override with `/config-audit full|
 node --test 'tests/**/*.test.mjs'
 ```
 
-1068 tests across 60 test files (19 lib + 31 scanner + 1 hook + 1 agent + 3 commands + 1 knowledge + 4 top-level). Test fixtures in `tests/fixtures/`. Top-level humanizer tests: `json-backcompat.test.mjs`, `raw-backcompat.test.mjs`, `scenario-read-test.test.mjs`, `snapshot-default-output.test.mjs`.
+1091 tests across 62 test files (20 lib + 32 scanner + 1 hook + 1 agent + 3 commands + 1 knowledge + 4 top-level). Test fixtures in `tests/fixtures/`. Top-level humanizer tests: `json-backcompat.test.mjs`, `raw-backcompat.test.mjs`, `scenario-read-test.test.mjs`, `snapshot-default-output.test.mjs`.
 
 ### active-config-reader — load-pattern model + rule/agent/output-style enumeration (v5.6 Foundation)
 
@@ -393,6 +394,31 @@ scanner → scanner count stays 15; agents 6→7, commands 18→19, suite 1055
 the shared `withHermeticHome` helper — the suite is green on BOTH a real and a clean `HOME` (the OPT
 section's old «run with clean HOME» caveat is resolved). Snapshot/byte tests were already hermetic.
 
+### knowledge-refresh — the "living" half of the register (v5.7 Fase 1 Chunk 3, commands 19→20)
+
+Keeps `knowledge/best-practices.json` current so the optimization lens never reads stale rules.
+Same hybrid split as Chunk 2b — a deterministic, byte-stable, unit-tested core + a web/judgment shell:
+
+- **Deterministic core** (`scanners/lib/knowledge-refresh.mjs`, pure, 15 tests): `assessFreshness(register,
+  {referenceDate, staleAfterDays})` classifies each entry `fresh`/`stale` by the age of its
+  `source.verified` stamp. `referenceDate` is **injected** (not read from the clock) so the function is
+  fully deterministic; default threshold `STALE_AFTER_DAYS_DEFAULT = 90` (quarterly re-verify cadence).
+  An unparseable/missing `verified` → stale with `ageDays: null` (defensive; the schema-validated bundle
+  never hits this, but the command's hand-built candidates might). «Source changed» detection is a **web
+  responsibility** (command layer), **not** in this core.
+- **CLI** (`scanners/knowledge-refresh-cli.mjs`, `-cli` → **NOT** an orchestrated scanner → scanner count
+  stays 15, suite byte-stable; 8 tests): read-only — it NEVER writes the register and NEVER hits the
+  network. `--reference-date` (defaults to today; the **only** place the clock is read) makes it
+  deterministically testable against the bundled register. `--stale-after N`, `--dry-run` (implicit + only
+  mode, echoed as `requestedDryRun`). Exit **0** = all fresh, **1** = some stale (advisory), **3** = error.
+- **Command** (`commands/knowledge-refresh.md`, opus): orchestrates CLI stale-report → re-verify each stale
+  entry by re-reading its `source.url` (WebFetch) → poll CC changelog + Anthropic blog for new/changed
+  practices (WebSearch) → present everything → **apply ONLY human-approved writes**, then re-run the
+  register schema test before declaring done. **No unverified claim is ever auto-written** (Verifiseringsplikt).
+  Web/judgment-driven → **deliberately NOT byte-stable** (own command, outside the snapshot suite), exactly
+  like `/config-audit optimize`. **No new agent** (web poll runs in the command's own context), **no new
+  orchestrated scanner**. suite 1068→1091.
+
 ## Gotchas
 
 - Session directories accumulate — use `/config-audit cleanup` to manage