release: v5.4.0 — plugin-hygiene & settings-validation hardening

Three additive findings extend existing PLH and SET scanners (scanner count
stays 13; --json/--raw byte-stable):
- CA-PLH-015 plugin-folder shadowing — a plugin.json component-path key in the
  replaces-set (commands/agents/outputStyles) pointing at a custom path while
  the default folder still exists; mirrors CC /doctor & claude plugin list.
- CA-PLH-016 skills:-array validation — each entry must resolve to a directory
  inside the plugin root; flags non-string/escapes-root/not-found/not-a-directory;
  mirrors claude plugin validate.
- CA-SET autoMode — structure (only environment/allow/soft_deny/hard_deny string
  arrays; "$defaults" valid) = medium; dead-config (autoMode in shared
  .claude/settings.json is not read by CC) = low.

Release mechanics: version 5.3.0 -> 5.4.0 (plugin.json); CHANGELOG [5.4.0];
README badge/TOC/What's-New/version-history; knowledge v5.4.0 scanner-backing
facts. Gates: suite 949/949, self-audit A/A + readmeCheck.passed (count 13),
SC-5 byte-equal, gitleaks clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8

CHANGELOG.md

@@ -5,6 +5,47 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.4.0] - 2026-06-19
+
+### Summary
+Plugin-hygiene & settings-validation hardening. Three additive findings extend the existing PLH and
+SET scanners — no new scanner file, so the scanner count stays **13**. PLH gains plugin-folder
+shadow detection and `skills:`-array validation; the settings validator now checks `autoMode`
+structure and flags it when placed in shared project settings, where Claude Code does not read it.
+Scanner internals only — no command, agent, or output-format changes; `--json` and `--raw` remain
+byte-stable.
+
+### Added
+- **PLH plugin-folder shadowing** (`CA-PLH-015`) — flags a `plugin.json` component-path key in the
+  *replaces* set (`commands`/`agents`/`outputStyles`) that points at a custom path while the
+  default folder of that name still exists on disk, so the folder is silently ignored (dead
+  config). Mirrors Claude Code's own warning in `/doctor`, `claude plugin list`, and the `/plugin`
+  detail view (v2.1.140+). Severity **medium**, `category: 'plugin-hygiene'`,
+  `details: { field, ignoredDir, customPaths }`. Deliberately excludes `skills` (adds to the
+  default scan, never shadows) and `hooks`/`mcpServers`/`lspServers` (own merge rules); honors the
+  explicit-address exception (a custom path resolving *into* the default folder is not flagged).
+- **PLH `skills:`-array validation** (`CA-PLH-016`) — validates each `plugin.json` `skills` entry
+  (string or array) resolves to an existing directory inside the plugin root; one finding per bad
+  entry with `problem` ∈ `non-string` / `escapes-root` / `not-found` / `not-a-directory`. Mirrors
+  `claude plugin validate` (~2.1.145). Severity **medium**, `category: 'plugin-hygiene'`,
+  `details: { field: 'skills', entry, problem }`. Path-escape detection is containment-based
+  (resolve + plugin-root prefix), backed by the docs' path-traversal rule.
+- **SET autoMode structure + dead-config** (`CA-SET`) — `autoMode`, if present, must be an object
+  whose only keys are `environment`/`allow`/`soft_deny`/`hard_deny`, each a **string array** (the
+  literal `"$defaults"` is a valid entry); unknown sub-keys and wrong value types are flagged
+  (`problem` ∈ `not-an-object` / `unknown-subkey` / `not-string-array`), severity **medium**.
+  Separately, `autoMode` placed in **shared** project settings (`.claude/settings.json`) is flagged
+  as dead config (`problem: 'shared-project-scope'`), severity **low** — Claude Code's classifier
+  does not read `autoMode` from shared project settings. The two sub-checks are independent. Both
+  verified against `code.claude.com/docs/en/auto-mode-config`.
+
+### Internal
+- **Test count** — 936 → **949** (+13: PLH-015, PLH-016, and SET autoMode structure/dead-config).
+- **Scanner count stays 13** — all three findings extend existing PLH and SET scanners; no new
+  scanner file, no badge/table/`countScannerShape` change.
+- **Byte-stability** — `json-backcompat` + `raw-backcompat` + the SC-5 default-output snapshot stay
+  green; the three findings are additive and appear only in configs that trigger them.
+
 ## [5.3.0] - 2026-06-19
 
 ### Summary