fix(acr): SET typo-gates unknown-key false positives (M-BUG-10)

The CC settings schema is passthrough (verified against the 2.1.193 binary): it
forwards unrecognized keys unchanged rather than rejecting them, so an arbitrary
unknown key is valid/forward-compatible, not an error — the finding's "silently
ignored" claim was factually wrong. The only real risk is a TYPO of a real key
(the intended setting then silently has no effect). Fix: flag an unknown key only
when it closely matches a known key (new levenshtein helper; edit distance <= 2,
both keys >= 4 chars); severity medium -> low; honest passthrough framing in the
scanner + humanizer. Also refreshed KNOWN_KEYS with 6 binary-verified keys
(agentPushNotifEnabled, remoteControlAtStartup, skipAutoPermissionPrompt,
skipDangerousModePermissionPrompt, skipWorkflowUsageWarning, tui). Suite 1341/0
(+12). Frozen v5.0.0 snapshots untouched (0 CA-SET findings there), no re-seed.
Dogfood ~/.claude/settings.json 6->0 (all 6 keys above were false unknown-key
findings; 0 typo flags introduced across 167 walked files).

tests/lib/string-utils.test.mjs

@@ -1,6 +1,6 @@
 import { describe, it } from 'node:test';
 import assert from 'node:assert/strict';
-import { lineCount, truncate, isSimilar, extractKeys, normalizePath } from '../../scanners/lib/string-utils.mjs';
+import { lineCount, truncate, isSimilar, extractKeys, normalizePath, levenshtein } from '../../scanners/lib/string-utils.mjs';
 
 describe('lineCount', () => {
   it('counts lines correctly', () => {
@@ -90,6 +90,42 @@ describe('extractKeys', () => {
   });
 });
 
+describe('levenshtein', () => {
+  it('returns 0 for identical strings', () => {
+    assert.strictEqual(levenshtein('permissions', 'permissions'), 0);
+  });
+
+  it('counts a single substitution as 1', () => {
+    assert.strictEqual(levenshtein('model', 'modet'), 1);
+  });
+
+  it('counts a single deletion as 1 (permisions → permissions)', () => {
+    assert.strictEqual(levenshtein('permisions', 'permissions'), 1);
+  });
+
+  it('counts a single insertion as 1', () => {
+    assert.strictEqual(levenshtein('hooks', 'hooks2'), 1);
+  });
+
+  it('counts a transposition as 2 (standard Levenshtein)', () => {
+    assert.strictEqual(levenshtein('import', 'improt'), 2);
+  });
+
+  it('returns the other length when one string is empty', () => {
+    assert.strictEqual(levenshtein('', 'abc'), 3);
+    assert.strictEqual(levenshtein('abc', ''), 3);
+    assert.strictEqual(levenshtein('', ''), 0);
+  });
+
+  it('is symmetric', () => {
+    assert.strictEqual(levenshtein('effortLevel', 'efortLevel'), levenshtein('efortLevel', 'effortLevel'));
+  });
+
+  it('gives a large distance for unrelated keys', () => {
+    assert.ok(levenshtein('unknownKey123', 'permissions') > 2);
+  });
+});
+
 describe('normalizePath', () => {
   it('expands ~ to HOME', () => {
     const home = process.env.HOME;