release: v5.4.1 — scanner-correctness patch (HKV/RUL/PLH)

Bundles four primary-source-verified scanner fixes since v5.4.0:
- HKV: +Setup/UserPromptExpansion/PostToolBatch; removed post-session
  (a self-hosted-runner lifecycle hook, not a settings.json event)
- RUL: globs-rule wording corrected (only paths: is documented)
- PLH: optional model/tools/name/allowed-tools no longer required;
  CLAUDE.md component-section required only for shipped components

Count stays 13, --json/--raw byte-stable, suite 954, self-audit A/A,
--check-readme passed. Version-history + CHANGELOG updated; badges bumped.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8

CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.4.1] - 2026-06-20
+
+### Summary
+Scanner-correctness patch. Five primary-source-verified fixes to the PLH, HKV, and RUL scanners —
+no new scanner, no command or output-format change (scanner count stays **13**; `--json` and `--raw`
+remain byte-stable). All fixes are anchored to the live Claude Code docs (`code.claude.com/docs`,
+docs map 2026-06-19) per the project's verification duty.
+
+### Fixed
+- **HKV hook events** — added `Setup`, `UserPromptExpansion`, and `PostToolBatch` to the valid-event
+  set (verified against `hooks.md`); a valid hook using one of these was wrongly flagged
+  "Unknown hook event … will never fire", which could lead a user to delete a working hook. The
+  "(N total)" hint in the recommendation is now derived from the set so it cannot drift.
+- **HKV `post-session`** — removed from the valid-event set. The 2.1.169 changelog `post-session`
+  hook is a **self-hosted-runner** workspace-lifecycle hook (runs after the session, before the
+  workspace is deleted), **not** a `settings.json` hook event — it is absent from `hooks.md` (all
+  settings.json events are PascalCase). A bogus `post-session` settings hook is now correctly flagged.
+- **RUL `globs` rule** — reworded the finding. Only `paths:` is documented as the rule-scoping
+  field; whether Claude Code ever read `globs` is unverified, so the previous "deprecated/legacy"
+  framing overclaimed. The finding (and its humanizer entry) now steer to the documented `paths:`
+  field without asserting deprecation. The coupled fix-engine title match was updated in lockstep.
+- **PLH required frontmatter** — `model`/`tools`/`name`/`allowed-tools` are optional per the CC
+  agent/command docs; a missing one is no longer flagged.
+- **PLH CLAUDE.md component sections** — a commands/agents/hooks section is required only for a
+  component the plugin actually ships.
+
 ## [5.4.0] - 2026-06-19
 
 ### Summary