feat(tok,acr): v5.6 B2 — load-pattern column in token-hotspots

Annotate every ranked TOK hotspot with the load-pattern triple
(loadPattern/survivesCompaction/derivationConfidence):

- hotspotLoadPattern() maps each discovery `type` → a deriveLoadPattern kind.
  Rules reuse activeConfig.rules for precise `scoped` handling; claude-md maps
  by scope. Two new deriveLoadPattern kinds back the rest: `command`
  (on-demand — body loads on /invoke) and `harness-config` (external —
  settings/keybindings/.mcp.json/hooks.json/plugin.json configure the CLI, not
  the model context, so they cost no per-turn context tokens). Honest split:
  the .mcp.json FILE is external; the MCP server's tool schemas are a separate
  `always` hotspot.

Byte-stability — the opposite of B1's manifest. token-hotspots IS a byte-equal
SC-6/SC-7 CLI, and its hotspots ride inside scan-orchestrator + posture, so the
change touched SIX frozen-v5.0.0 comparisons across five test files. Resolved by
preserving the frozen baselines: a shared tests/helpers/strip-hotspot-load-pattern.mjs
strips the additive triple before each byte-equal compare (proves the original
schema is byte-identical). SC-5 default-output snapshots (scan-orchestrator +
token-hotspots) regenerated — diff reviewed as additive-only.

Tests 1008→1012. Self-audit A/A, scanner count unchanged at 13 (C bumps to 14).
Completes v5.6 B (B1 manifest + B2 token-hotspots).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/json-backcompat.test.mjs

@@ -29,6 +29,7 @@ import { promisify } from 'node:util';
 import { readFile, writeFile, access, mkdir } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { hermeticEnv, HERMETIC_HOME } from './helpers/hermetic-home.mjs';
+import { stripHotspotLoadPattern } from './helpers/strip-hotspot-load-pattern.mjs';
 
 const exec = promisify(execFile);
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -102,7 +103,7 @@ function normalizeScanOrchestrator(env) {
     }
   }
   stripAncestorDerived(out);
-  return out;
+  return stripHotspotLoadPattern(out);
 }
 
 function normalizePosture(p) {
@@ -119,13 +120,13 @@ function normalizePosture(p) {
     }
     stripAncestorDerived(out.scannerEnvelope);
   }
-  return out;
+  return stripHotspotLoadPattern(out);
 }
 
 function normalizeTokenHotspots(p) {
   const out = JSON.parse(JSON.stringify(p));
   out.duration_ms = 0;
-  return out;
+  return stripHotspotLoadPattern(out);
 }
 
 function normalizeDrift(p) {