release: v5.2.0 — CC 2.1.114→181 compat + skill-listing budget (SKL)

New orchestrated scanner SKL (CA-SKL-001 1,536-char listing cap, CA-SKL-002
listing-budget sum) → 13 orchestrated scanners. Five validators refreshed for
the CC 2.1.114→181 settings/hook surface (xhigh effort, MessageDisplay +
post-session events). False positives eliminated in MCP and permissions
scanners. Hermetic HOME isolation across all CLI-spawning tests.

Version sync: plugin.json 5.1.0→5.2.0, README badges (version + tests-875+),
5 stale "12→13 scanners" prose fixes, What's New + version-history rewrite,
CHANGELOG [5.2.0] entry. 875/875 tests; self-audit configGrade A, pluginGrade A,
readmeCheck.passed:true.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8

CHANGELOG.md

@@ -5,6 +5,54 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.2.0] - 2026-06-18
+
+### Summary
+Claude Code 2.1.114→181 compatibility + skill-listing budget release. Adds a new
+orchestrated scanner (SKL) for the model's skill-listing token budget, refreshes five
+validators to recognize the settings/hook surface shipped across CC 2.1.114–181, and
+eliminates a batch of false positives surfaced by an adversarial gap-review. Scanner
+internals only — no command, agent, or output-format changes.
+
+### Added
+- **`scanners/skill-listing-scanner.mjs` (SKL)** — new orchestrated deterministic scanner
+  (→ 13 orchestrated scanners). `CA-SKL-001` (medium): an active skill description over the
+  verified 1,536-char listing cap (CC 2.1.105) is silently truncated in the model's skill
+  listing. `CA-SKL-002` (low): the summed length of all active descriptions (each counted up
+  to the cap) over the listing budget (~2% of context, CC 2.1.32) — anchored on a conservative
+  200k window with a note that the budget scales 5× on 1M-context models; leads with the
+  measured sum, an estimate not telemetry. HOME-scoped (all user + plugin skills). Remediation
+  surfaces `disableBundledSkills` / `skillOverrides` / description trimming.
+
+### Changed
+- **settings-validator** — accepts CC 2.1.114–181 settings keys and `xhigh` reasoning effort.
+- **hook-validator** — recognizes `MessageDisplay` and post-session hook events (28 events).
+- **claude-md-linter** — CLAUDE.md length reframed from a HIGH "adherence cliff" to a MEDIUM
+  token-cost finding (model-neutral, context-window aware).
+- **tokens** — stale "Opus 4.7" framing refreshed to model-neutral with an Opus 4.8 anchor.
+- **Knowledge corpus** — refreshed to the Opus 4.8 era (CC 2.1.114→181).
+
+### Fixed
+- **mcp-config-validator** — no longer flags auto-injected or POSIX-style env vars; removed an
+  invented `trust` field that does not exist in the MCP config schema.
+- **permissions (DIS/CNF)** — dead-allow detection and conflict matching are now parameter-aware,
+  removing false positives on parameterized permission rules.
+
+### Internal
+- **Hermetic test isolation** — byte/snapshot tests and all 12 CLI-spawning test files now isolate
+  `HOME` via the `hermetic-home` helper, closing a leak class where the real `~/.claude` skills and
+  config bled into fixture-scoped runs (notably SKL, which is HOME-scoped regardless of
+  `includeGlobal`). Adversarially verified via a devil's-advocate gap-review pass.
+
+### Test count
+- 792 → 875 tests across 52 → 55 test files.
+
+### Verification
+- 875/875 tests pass (`node --test 'tests/**/*.test.mjs'`).
+- `node scanners/self-audit.mjs --json --check-readme` → `configGrade: A` (96),
+  `pluginGrade: A` (100), `readmeCheck.passed: true`.
+- README badge updated: `tests-792+` → `tests-875+`.
+
 ## [5.1.0] - 2026-05-01
 
 ### Summary