release: v5.4.1 — scanner-correctness patch (HKV/RUL/PLH)

Bundles four primary-source-verified scanner fixes since v5.4.0:
- HKV: +Setup/UserPromptExpansion/PostToolBatch; removed post-session
  (a self-hosted-runner lifecycle hook, not a settings.json event)
- RUL: globs-rule wording corrected (only paths: is documented)
- PLH: optional model/tools/name/allowed-tools no longer required;
  CLAUDE.md component-section required only for shipped components

Count stays 13, --json/--raw byte-stable, suite 954, self-audit A/A,
--check-readme passed. Version-history + CHANGELOG updated; badges bumped.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "config-audit",
   "description": "Multi-agent workflow for analyzing, reporting, and optimizing Claude Code configuration across your entire machine",
-  "version": "5.4.0",
+  "version": "5.4.1",
   "author": {
     "name": "Kjell Tore Guttormsen"
   },