feat(ost): v5.6 C — output-style scanner (CA-OST, count 13→14)

New orchestrated scanner output-style-scanner.mjs — first new family since
SKL. Three findings, each pinned to a CONFIRMED V-row of the steering-model
plan + re-verified against code.claude.com/docs/en/output-styles:

- CA-OST-001 (medium, V10): user/project custom style missing
  keep-coding-instructions:true (default false) → silently strips built-in
  software-engineering instructions when active. Scoped to user/project.
- CA-OST-002 (low, V11): plugin style with force-for-plugin:true overrides the
  user's selected outputStyle. Verifiseringsplikt correction — the plan bullet
  said "project/user style," but force-for-plugin is plugin-styles-only per the
  docs, so the check keys on source==='plugin'.
- CA-OST-003 (medium): settings outputStyle matching no built-in
  (Default/Explanatory/Learning/Proactive, case-insensitive) nor discovered
  custom style → dead config.

Byte-stability — a scanner addition, not a field addition. Growing the
scanners array + scanners_ok cannot be hidden by a field strip, but re-seeding
frozen v5.0.0 (the SKL precedent) would now bake in B2's hotspot triple +
claudeMd drift. So, per the B2 lesson, frozen v5.0.0 snapshots are PRESERVED
and the OST entry is stripped at compare time via new
tests/helpers/strip-added-scanner.mjs (wired into json/raw-backcompat + the
Step 5/6 humanizer tests); only SC-5 default-output is regenerated (additive
OST entry, diff reviewed). OST is fixture-gated (no output styles on
marketplace-medium / hermetic HOME → silent).

Wiring: orchestrator; humanizer (OST→Configuration mistake) + humanizer-data
OST family (title-coupled); scoring (OST→Settings, keeps 10 areas). Suite
1012→1023 (+11). Badges: scanners 14, tests 1023, TRANSLATIONS families 15.
Lore swept: README, CLAUDE.md, scanner-internals, humanizer.md. self-audit A/A.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/helpers/strip-added-scanner.mjs

@@ -0,0 +1,62 @@
+/**
+ * v5.6 C added the OST (Output-Style Validation) scanner — a 14th orchestrated
+ * scanner. The frozen v5.0.0 byte-equal baselines predate it (13 scanners), so
+ * this strips the additive OST scanner entry before comparison, the same way
+ * strip-hotspot-load-pattern.mjs handles B2's additive hotspot fields. Stripping
+ * (rather than re-seeding the frozen snapshots) keeps the strongest invariant:
+ * the ORIGINAL 13 scanners still emit byte-identical output, and the frozen
+ * snapshots stay free of post-v5.0.0 drift (the hotspot triple, ancestor token
+ * counts) that re-seeding would bake in.
+ *
+ * Removing a zero-finding scanner entry only moves `aggregate.scanners_ok`
+ * (OST is always status 'ok' and emits nothing on the deterministic fixture, so
+ * total_findings / counts / risk_score / verdict are unchanged). The strip
+ * decrements scanners_ok to match.
+ *
+ * Mutates in place and returns the payload for chaining inside a normalizer:
+ *   return stripAddedScanners(stripHotspotLoadPattern(out));
+ */
+
+const ADDED_SCANNERS = new Set(['OST']);
+
+function stripFromEnvelope(env) {
+  if (!env || typeof env !== 'object' || !Array.isArray(env.scanners)) return;
+  let removedOk = 0;
+  const kept = [];
+  for (const s of env.scanners) {
+    if (ADDED_SCANNERS.has(s.scanner)) {
+      if (s.status === 'ok') removedOk++;
+      continue;
+    }
+    kept.push(s);
+  }
+  env.scanners = kept;
+  if (env.aggregate && typeof env.aggregate.scanners_ok === 'number') {
+    env.aggregate.scanners_ok -= removedOk;
+  }
+}
+
+/**
+ * Strip added (post-v5.0.0) scanner entries from a CLI payload / envelope —
+ * both top-level (`scanners`) and nested (`scannerEnvelope.scanners`).
+ * @template T
+ * @param {T} payload
+ * @returns {T}
+ */
+export function stripAddedScanners(payload) {
+  if (!payload || typeof payload !== 'object') return payload;
+  stripFromEnvelope(payload);
+  if (payload.scannerEnvelope) stripFromEnvelope(payload.scannerEnvelope);
+  return payload;
+}
+
+/**
+ * Remove `[OST] …` per-scanner progress lines from a captured stderr scorecard,
+ * so a 14-scanner live run matches the frozen 13-scanner stderr snapshot.
+ * @param {string} text
+ * @returns {string}
+ */
+export function stripAddedScannerStderr(text) {
+  if (typeof text !== 'string') return text;
+  return text.replace(/^[ \t]*\[OST\][^\n]*\n/gm, '');
+}