feat(campaign): /config-audit campaign — human-approved write-CLI + command (v5.7 Fase 2 Block 3c)

Completes the THIN machine-wide campaign surface (ledger + roll-up + status).
The write half of the campaign motor, mirroring how knowledge-refresh gates
register writes:

- scanners/campaign-write-cli.mjs (-cli → NOT a scanner; 11 tests): init/add/
  set-status, each a thin wrapper over the invariant-enforcing lib transforms
  (createLedger/addRepo/setRepoStatus) + saveLedger — path-normalization/dedup,
  idempotent add, status-lifecycle guard and updatedDate bump never hand-rolled.
  init refuses to clobber an existing/corrupt ledger (exit 1, file untouched);
  add auto-inits + reports added vs skipped; set-status takes --findings/--session.
  Deterministic: --reference-date is the only clock read, injected as `now`.
  Exit 0=write, 1=advisory no-op, 3=error.
- commands/campaign.md (opus, no Web): thin orchestrator — always reports first
  (read-only campaign-cli), then proposes init/add/set-status and invokes ONE
  write-CLI subcommand only on explicit human approval (Verifiseringsplikt; never
  hand-edits the JSON). add --discover finds git repos under a root to pick from.

Not byte-stable (own command, outside snapshot suite) like /config-audit optimize
+ knowledge-refresh. Both CLIs are -cli → scanner count stays 15, snapshot suite
untouched. commands 20→21, suite 1127→1138 (+11), test files 64→65.

Docs: CLAUDE.md §campaign-write-cli + command table + Testing badge; README
commands badge 20→21 + table row; help.md + router wiring.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -35,6 +35,7 @@ Analyzes and optimizes Claude Code configuration across three pillars:
 | `/config-audit plugin-health` | Audit plugin structure, frontmatter, cross-plugin coherence |
 | `/config-audit whats-active` | Read-only inventory of plugins, skills, MCP, hooks, CLAUDE.md active for a repo (with token estimates) |
 | `/config-audit knowledge-refresh` | Keep the best-practices register fresh — deterministic stale check (sources older than ~90d) + web candidate poll (CC changelog + Anthropic blog); **human-approved writes only** (Verifiseringsplikt). The "living" half of the knowledge base. Web/judgment-driven, **not byte-stable** |
+| `/config-audit campaign` | Machine-wide audit campaign — durable ledger ABOVE sessions: per-repo lifecycle (pending→audited→planned→implemented) + machine-wide roll-up by severity, resumable across sessions. Read-only report (campaign-cli) + **human-approved** writes via a deterministic write-CLI (init/add/set-status). THIN: tracks state, doesn't run audits/fixes. Judgment-driven, **not byte-stable** |
 | `/config-audit discover` | Run discovery phase only |
 | `/config-audit analyze` | Run analysis phase only |
 | `/config-audit interview` | Gather user preferences (opt-in) |
@@ -112,7 +113,7 @@ Default: auto-detects scope from git context. Override with `/config-audit full|
 node --test 'tests/**/*.test.mjs'
 ```
 
-1127 tests across 64 test files (21 lib + 33 scanner + 1 hook + 1 agent + 3 commands + 1 knowledge + 4 top-level). Test fixtures in `tests/fixtures/`. Top-level humanizer tests: `json-backcompat.test.mjs`, `raw-backcompat.test.mjs`, `scenario-read-test.test.mjs`, `snapshot-default-output.test.mjs`.
+1138 tests across 65 test files (21 lib + 34 scanner + 1 hook + 1 agent + 3 commands + 1 knowledge + 4 top-level). Test fixtures in `tests/fixtures/`. Top-level humanizer tests: `json-backcompat.test.mjs`, `raw-backcompat.test.mjs`, `scenario-read-test.test.mjs`, `snapshot-default-output.test.mjs`.
 
 ### active-config-reader — load-pattern model + rule/agent/output-style enumeration (v5.6 Foundation)
 
@@ -447,6 +448,37 @@ writes, Verifiseringsplikt). `--ledger-file` overrides the default path (determi
 `--output-file` mirrors the sibling. Exit codes: **0** = initialized & valid, **1** = not initialized
 yet (advisory), **3** = error (parse/corrupt/invalid). suite 1119→1127.
 
+### campaign-write-cli + `/config-audit campaign` — the WRITE half (v5.7 Fase 2, Block 3c, commands 20→21)
+
+The human-approved mutation half of the campaign motor, completing the THIN campaign surface
+(ledger + roll-up + status). Two pieces:
+
+- **`scanners/campaign-write-cli.mjs`** (`-cli` → NOT an orchestrated scanner → scanner count stays
+  15, suite byte-stable; 11 tests): the sibling of `campaign-cli` that *mutates*. Subcommands
+  `init` / `add <path>...` / `set-status <path> <status>`, each a thin wrapper over the
+  invariant-enforcing lib transforms (`createLedger`/`addRepo`/`setRepoStatus`) + `saveLedger` — so
+  path-normalization/dedup, idempotent add, the status-lifecycle guard, and the `updatedDate` bump
+  are **never re-implemented by hand**. `init` refuses to clobber an existing (or corrupt) ledger
+  (**exit 1** advisory, file untouched); `add` **auto-inits** when no ledger exists and reports
+  `added` vs `skipped`; `set-status` accepts `--findings '<json>'` + `--session <id>`. Determinism
+  mirrors the lib + `knowledge-refresh-cli`: `--reference-date` is the **only** place the clock is
+  read (defaults to today), passed to the transforms as the injected `now`. Exit: **0** = write
+  performed, **1** = advisory no-op (init-clobber), **3** = error (unknown subcommand, bad args,
+  invalid status, untracked repo, no/corrupt ledger).
+- **`commands/campaign.md`** (opus, `allowed-tools: Read/Write/Edit/Bash/Glob` — **no Web**,
+  judgment-free): a thin orchestrator. It always **reports** first (read-only `campaign-cli`), then
+  for `init`/`add`/`set-status` it proposes the change and, **only on explicit human approval**,
+  invokes one write-CLI subcommand (Verifiseringsplikt — it never hand-edits the ledger JSON).
+  `add --discover <root>` finds git repos under a root and lets the user pick. When marking a repo
+  `audited` it attaches findings-by-severity from the repo's session (or user-provided counts) —
+  **never invented**.
+
+**Not a new scanner, not byte-stable.** Both CLIs carry the `-cli` suffix (out of the
+scan-orchestrator → scanner count stays **15**, snapshot suite untouched); the command's
+orchestration is judgment-driven and deliberately outside the snapshot suite, exactly like
+`/config-audit optimize` + `knowledge-refresh`. **No new agent** (web/judgment-free, runs in the
+command's own context). suite 1127→1138.
+
 ## Gotchas
 
 - Session directories accumulate — use `/config-audit cleanup` to manage