release: v5.12.4 — "Rooted rules" (M-BUG-9: RUL resolves rule glob against the rule's own project root)

Version-sync for the M-BUG-9 fix (code already in 18af5a2):
- plugin.json 5.12.3 -> 5.12.4
- README version badge -> 5.12.4, tests badge 1305 -> 1307, new version-history row
- CHANGELOG [5.12.4] section

checkReadmeBadges: passed:true (tests 1307, scanners 16, commands 21, agents 7, hooks 4 — all
match filesystem). Full suite 1307/0. Frozen v5.0.0 + default-output snapshots byte-stable
(the fix is a no-op when projectRoot === targetPath; RUL appears in no snapshot).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EnUvKEqyEa1m9gy6Aqhdqq

CHANGELOG.md

@@ -5,6 +5,36 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.12.4] - 2026-06-26
+
+### Summary
+"Rooted rules" — fixes `M-BUG-9` (dogfooding find) in `scanners/rules-validator.mjs`. The RUL
+"Rule path pattern matches no files" check resolved a rule's `paths:`/`globs:` glob against the
+outer **scan root** instead of the rule's **own project root** (the directory containing its
+`.claude/`), and `collectProjectFiles` carried a `depth>4` cutoff that never reached deep matching
+files. As a result, a live rule in a **nested repo** — e.g. a marketplace checkout under
+`~/.claude/plugins/marketplaces/<mkt>/.claude/rules/` — was wrongly flagged "never activates" (high
+severity), a false F-grade for any user with rules in a nested repo. Same scope-conflation family as
+`M-BUG-1/2` (the scanner treats a nested repo's config as scoped to the outer scan root). The fix is a
+no-op for the common single-repo scan (`projectRoot === targetPath`), so the frozen v5.0.0 +
+default-output snapshots stay byte-stable; no count change (scanners **16**, agents **7**, commands
+**21**). **1307** tests (+2).
+
+### Fixed
+- **`rules-validator` glob base (`M-BUG-9`).** The dead-rule check now resolves each rule against its
+  own project root:
+  - `deriveProjectRoot(ruleAbsPath)` returns the parent of the rule's `.claude` segment.
+  - Project files are collected and globbed **per project root** (cached), relative to that root, so a
+    nested repo's rule matches against its own tree where its files live. This also sidesteps the old
+    `depth>4` cutoff, because the walk now starts at the nearby project root.
+  - User-global rules (`projectRoot === $HOME`, i.e. `~/.claude/rules/`) skip the no-match check: they
+    scope against whatever project is active at runtime, not a fixed tree, so "matches 0 files here" is
+    not a dead-rule signal (and this avoids a `$HOME`-wide file walk).
+  - TDD: 2 failing tests (nested-repo false-positive + HOME guard) → fix → full suite 1307/0, frozen
+    v5.0.0 + default-output snapshots untouched (RUL findings appear in none). Real-machine verify: the
+    two `ktg-privat` false positives clear and a previously-hidden genuine dead rule (a false negative)
+    surfaces in the bundled `optimal-setup` example; zero new false positives.
+
 ## [5.12.3] - 2026-06-26
 
 ### Summary