feat(mft): v5.6 B1 — load-pattern accounting in manifest

Consume the v5.6 Foundation enumeration in buildManifest:

- Component-level sources: drop the coarse `kind:'plugin'` roll-up (it
  double-counted skills/rules/agents already enumerated once). Kinds are now
  claude-md/skill/rule/agent/output-style/mcp-server/hook.
- Every source carries loadPattern/survivesCompaction/derivationConfidence.
  Rules/agents/output-styles propagate the foundation-derived values; CLAUDE.md
  maps scope→kind (all cascade files always-loaded); skills are tagged on-demand
  (skill-body) so the body cost does not inflate the always-loaded subtotal.
- New `summary` (always/onDemand/external/unknown {tokens,count}); the
  always-loaded subtotal — "tokens that enter context every turn" — is the headline.

manifest is an environment-aware CLI → SC-6/SC-7 verify it by mode-equivalence,
not byte-equal, and it is not in SC-5. Adding fields in place keeps all snapshots
green with no regen (verified). `total` changes (de-duped) — intended correctness fix.
TOK's load-pattern column (byte-equal SC-6) is deferred to the next chunk (B2).

Tests 996→1008 (deterministic buildManifest unit test + CLI presence checks).
Self-audit A/A, scanner count unchanged at 13.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -18,7 +18,7 @@ Analyzes and optimizes Claude Code configuration across three pillars:
 | `/config-audit` | Full audit with auto-scope detection (no setup needed) |
 | `/config-audit posture` | Quick health scorecard (A-F grades, 10 quality areas incl. Token Efficiency, Plugin Hygiene) |
 | `/config-audit tokens` | prompt-cache-aware token hotspots (6 patterns: cache-breaking, redundant perms, deep imports, oversized cascade, bloated SKILL.md desc, MCP tool-schema budget) — optional `--accurate-tokens` API calibration, `--with-telemetry-recipe` cache-hit recipe pointer |
-| `/config-audit manifest` | Ranked table of every system-prompt token source (CLAUDE.md, plugins, skills, MCP, hooks) sorted by estimated tokens |
+| `/config-audit manifest` | Ranked table of every token source (CLAUDE.md, rules, agents, skills, output styles, MCP, hooks) sorted by estimated tokens, each tagged with its load pattern (always-loaded / on-demand / external) + an always-loaded subtotal ("tokens that enter context every turn") |
 | `/config-audit feature-gap` | Context-aware feature recommendations grouped by impact (incl. a conditional `disableBundledSkills` lever when the active skill listing is over budget — remediation companion to SKL `CA-SKL-002`) |
 | `/config-audit fix` | Auto-fix deterministic issues with backup + verification |
 | `/config-audit rollback` | Restore configuration from backup |
@@ -109,7 +109,7 @@ Default: auto-detects scope from git context. Override with `/config-audit full|
 node --test 'tests/**/*.test.mjs'
 ```
 
-996 tests across 56 test files (17 lib + 29 scanner + 1 hook + 1 agent + 3 commands + 1 knowledge + 4 top-level). Test fixtures in `tests/fixtures/`. Top-level humanizer tests: `json-backcompat.test.mjs`, `raw-backcompat.test.mjs`, `scenario-read-test.test.mjs`, `snapshot-default-output.test.mjs`.
+1008 tests across 56 test files (17 lib + 29 scanner + 1 hook + 1 agent + 3 commands + 1 knowledge + 4 top-level). Test fixtures in `tests/fixtures/`. Top-level humanizer tests: `json-backcompat.test.mjs`, `raw-backcompat.test.mjs`, `scenario-read-test.test.mjs`, `snapshot-default-output.test.mjs`.
 
 ### active-config-reader — load-pattern model + rule/agent/output-style enumeration (v5.6 Foundation)
 
@@ -131,6 +131,32 @@ false-positive (a block-sequence-scoped rule was misread as unscoped). An empty-
 no following `- ` items still resolves to `null` (backwards-compatible); only a real `- ` item
 list becomes an array.
 
+### manifest — load-pattern accounting (v5.6 B)
+
+`buildManifest` (`scanners/manifest.mjs`) now consumes the Foundation enumeration. Two changes:
+
+1. **Component-level sources (plugin roll-up dropped).** The coarse `kind:'plugin'` aggregate is
+   gone. A plugin contributes via its skills/rules/agents/output-styles/hooks/MCP — each already
+   enumerated **once** by `readActiveConfig` — so the old roll-up double-counted them (the plugin
+   aggregate's `estimatedTokens` already summed its components). Source kinds are now
+   `claude-md`/`skill`/`rule`/`agent`/`output-style`/`mcp-server`/`hook`.
+2. **Load-pattern triple on every record + a `summary`.** Each source carries
+   `loadPattern`/`survivesCompaction`/`derivationConfidence`. Rules/agents/output-styles
+   **propagate** the foundation-derived values (rules vary by `scoped`); CLAUDE.md maps `scope`→
+   kind via `CLAUDE_MD_SCOPE_KIND` (all cascade files walk **up**, so all are always-loaded);
+   skills are tagged **on-demand** via `deriveLoadPattern('skill-body')` — the measured tokens are
+   the skill **body** (paid on invoke), not the tiny always-loaded name+desc listing (tracked by
+   `skill-listing-budget`/posture), so tagging the body always would inflate the headline. The new
+   `summary` buckets sources into `always`/`onDemand`/`external`/`unknown` `{tokens,count}`; the
+   **always-loaded subtotal** ("≈X tokens enter context every turn before you type") is the headline.
+
+**Byte-stability.** manifest is an **environment-aware CLI** → SC-6/SC-7 verify it by
+**mode-equivalence** (`--json == --raw`), not byte-equal against a frozen snapshot, and it is not in
+SC-5 default-output. Adding fields in place therefore keeps all snapshots green with **no regen**
+(verified). `total` changes (de-duped, component-level) — that is the intended correctness fix.
+**TOK's load-pattern column is deferred to the next chunk** (it *is* a byte-equal SC-6 CLI, so it
+needs snapshot handling); this chunk is manifest-only.
+
 ### CML scanner — context-window-scaled char budget
 
 Beyond the line-count checks (200/500 lines, both MEDIUM), the CML scanner mirrors