feat(skill-listing): add CA-SKL-002 aggregate listing-budget check

Syklus 2 of Fase 4 Items 2+3. Flags when the sum of active skill
descriptions exceeds the listing budget (~2% of context, CC 2.1.32).

Design (operator-confirmed "fact-first, 200k anchor"):
- low severity (estimate) vs medium for the verified 1,536-char cap
- each description counted up to the 1,536 cap (what actually loads in
  the listing) — avoids double-counting the tail CA-SKL-001 flags
- fires when sum > 2% x 200k = 4000 tok; evidence leads with the measured
  sum + a calibration note that the budget scales 5x on 1M-context models
- aggregate emitted after the per-skill loop so the common case reads
  001=cap, 002=aggregate (finding IDs are a sequential counter, not stable
  semantic IDs — tests match on title, never NNN)

Also:
- tailored humanizer static entry for the aggregate title
- fix latent HOME leak in posture-grade-stability.test.mjs: it spawned
  posture.mjs without hermeticEnv(), so a real ~/.claude leaked HOME-scoped
  SKL/COL findings into the baseline grade (Token Efficiency A->B). Now
  isolated like the 8 other CLI-spawning tests.
- docs sync: test count 868->875, scanner-internals, gap-matrix, plan status

Suite 875/875, no snapshot drift, self-audit clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8

tests/scanners/posture-grade-stability.test.mjs

@@ -4,6 +4,7 @@ import { resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
+import { hermeticEnv } from '../helpers/hermetic-home.mjs';
 
 const exec = promisify(execFile);
 const __dirname = fileURLToPath(new URL('.', import.meta.url));
@@ -11,9 +12,13 @@ const FIXTURES = resolve(__dirname, '../fixtures');
 const POSTURE_BIN = resolve(__dirname, '../../scanners/posture.mjs');
 
 async function runPostureJson(fixturePath) {
+  // Isolate HOME: SKL and COL are HOME-scoped (enumerateSkills/enumeratePlugins),
+  // so a real ~/.claude would leak the developer's installed plugins/skills into
+  // this baseline grade and make it machine-dependent. See tests/helpers/hermetic-home.mjs.
   const { stdout } = await exec('node', [POSTURE_BIN, fixturePath, '--json'], {
     timeout: 30000,
     cwd: resolve(__dirname, '../..'),
+    env: hermeticEnv(),
   });
   return JSON.parse(stdout);
 }