release: v5.12.5 — "Dogfood denoise" (M-BUG-2/6/7/8/10 scanner false-positive batch)

Version-sync for the Fase-3 scanner false-positive batch (code already shipped in
bfd577a / dd9db60 / 7e94910 / 3cf5c71 / e8afb14):
- plugin.json 5.12.4 -> 5.12.5
- README version badge -> 5.12.5, tests badge 1307 -> 1344, new version-history row
- CHANGELOG [5.12.5] section (per-bug Fixed entries)

Batch theme: five scanners stop counting non-user / non-live config as the user's authored
cascade (plugin-bundled config, frozen backups, doc examples, forward-compatible settings keys).

checkReadmeBadges: passed:true (tests 1344, scanners 16, commands 21, agents 7, hooks 4 — all
match filesystem). Full suite 1344/0. Frozen v5.0.0 + SC-5 + default-output snapshots byte-stable;
no re-seed across all five fixes (each affected fixture's findings are genuinely unchanged).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EnUvKEqyEa1m9gy6Aqhdqq

CHANGELOG.md

@@ -5,6 +5,63 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.12.5] - 2026-06-26
+
+### Summary
+"Dogfood denoise" — a samle-release of the Fase-3 scanner false-positive batch: `M-BUG-2/6/7/8/10`,
+all dogfooding finds from running config-audit on the maintainer's real `~/.claude`. The shared theme
+is **non-user / non-live config wrongly counted as the user's authored cascade**: installed plugins'
+bundled config, frozen backup copies, doc examples, and forward-compatible settings keys all produced
+findings the user could neither act on nor was responsible for. No new scanner, command, agent, or hook
+(counts stay scanners **16**, agents **7**, commands **21**, hooks **4**); all five fixes are byte-stable
+— the frozen v5.0.0 + SC-5 + default-output snapshots are untouched and **no fixture was re-seeded**
+(verified per bug: each affected fixture's findings are genuinely unchanged because the snapshot fixtures
+contain none of the triggering paths/tokens). **1344** tests (+37).
+
+### Fixed
+- **`conflict-detector` segregates plugin-bundled config (`M-BUG-2`).** CNF compared every discovered
+  `settings.json`/`hooks.json` pairwise regardless of origin, so it treated installed plugins' bundled
+  configs — each plugin's own settings/hooks plus its shipped fixtures and examples under
+  `~/.claude/plugins/` — as the user's cascade. A "conflict" between two plugins' bundled test fixtures
+  is not user-resolvable, yet these dominated the count (dogfood **339** findings: 315 high-sev
+  allow/deny, 18 duplicate-hook, 6 settings-key — Conflicts grade F on ~100% plugin noise). Fix: a new
+  `isPluginBundled` predicate excludes any file whose absolute path is under `.claude/plugins/` from
+  conflict analysis. Kept **CNF-local, not a discovery-level skip** on purpose — an active plugin's
+  contributed `hooks.json`/`.mcp.json` legitimately lives in `plugins/cache` and other scanners need it;
+  only conflict analysis must ignore plugin-bundled files. Same class as `M-BUG-8`. Dogfood **339→0**
+  (the ~3 genuine user-scope local settings have no actually-conflicting keys). +3 tests (plugin-bundled
+  exclusion, discovery-side sanity, over-exclusion guard).
+- **`file-discovery` skips `backups/` (`M-BUG-8`).** A directory named `backups` holds backup COPIES, not
+  live config, so walking it during an audit produces stale findings. config-audit's own session backups
+  (`~/.claude/config-audit/backups/<ts>/files/.../CLAUDE.md`) were the canonical case: a `~/.claude`-scope
+  audit walked 36 frozen copies as if live, polluting CPS and HKV/RUL. Fix: add `backups` to `SKIP_DIRS`
+  (broad, name-based — consistent with `vendor`/`dist`/`.cache`). Dogfood files-under-`/backups/`
+  **36→0**, 717 live config files retained. +3 tests.
+- **token estimator discounts block-level HTML comments (`M-BUG-6`).** CLAUDE.md token estimates counted
+  block-level `<!-- -->` comments toward always-loaded tokens, but CC strips them before injection
+  (preserved only inside code fences, per `code.claude.com/docs/en/memory`). Fix: new
+  `stripInjectedHtmlComments` + `effectiveMemoryBytes` in `active-config-reader`; the CML cascade and
+  `token-hotspots` now size CLAUDE.md from effective (stripped) bytes while raw byte figures stay honest.
+  Block-level only — inline comments retained (conservative, verified scope). Dogfood `~/.claude` CLAUDE.md
+  ~3386→3301 tok (~85 tok). +13 tests.
+- **`cache-prefix-stability` ignores code + CC-stable path vars (`M-BUG-7`).** CPS flagged
+  `${CLAUDE_PLUGIN_ROOT}`/`${CLAUDE_PROJECT_DIR}` (CC-provided stable paths) and `{date}`/timestamp tokens
+  shown in documentation as cache-busters. Fix: skip fenced code blocks, strip inline-code spans, and
+  whitelist CC-stable vars before pattern-matching. Suppress-only — frozen v5.0.0 snapshots untouched
+  (CPS yields `findings:[]` there). Dogfood **5→2** (3 doc false-positives suppressed; 2 remaining are
+  own volatile test fixtures). +6 tests.
+- **`settings-validator` typo-gates unknown keys (`M-BUG-10`).** The CC settings schema is passthrough
+  (verified against the 2.1.193 binary): it forwards unrecognized keys unchanged rather than rejecting
+  them, so an arbitrary unknown key is forward-compatible, not an error — the finding's "silently ignored"
+  claim was factually wrong. The only real risk is a TYPO of a real key (the intended setting then
+  silently has no effect). Fix: flag an unknown key only when it closely matches a known key (new
+  `levenshtein` helper; edit distance ≤2, both keys ≥4 chars); severity medium→low; honest passthrough
+  framing in scanner + humanizer. Also refreshed `KNOWN_KEYS` with 6 binary-verified keys
+  (`agentPushNotifEnabled`, `remoteControlAtStartup`, `skipAutoPermissionPrompt`,
+  `skipDangerousModePermissionPrompt`, `skipWorkflowUsageWarning`, `tui`). Dogfood
+  `~/.claude/settings.json` **6→0** (all 6 were false unknown-key findings; 0 typo flags introduced across
+  167 walked files). +12 tests.
+
 ## [5.12.4] - 2026-06-26
 
 ### Summary