chore(release): config-audit v5.7.0 — optimization lens + living knowledge layer

Release-cut for v5.7 Fase 1 (Chunks 1/2a/2b/3):
- best-practices register (knowledge/best-practices.json)
- CA-OPT-001 deterministic optimization-lens scanner (count 14→15)
- /config-audit optimize + optimization-lens-agent (opus, agents 6→7)
- /config-audit knowledge-refresh (commands 19→20)

plugin.json 5.6.0→5.7.0, README version badge + version-history row,
CHANGELOG [5.7.0] entry. Count badges already track filesystem
(self-audit --check-readme: passed). Suite 1091 green (hermetic HOME),
self-audit A/A (config 94, plugin 100).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,52 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.7.0] - 2026-06-21
+
+### Summary
+"Optimization lens" — the first detector of the **«is this config optimally shaped?»** axis, on top
+of the existing «is it correct?» checks, plus a **living** machine-readable knowledge layer that keeps
+the lens's rules fresh. A config that *works* can still fit a better mechanism (a long CLAUDE.md
+procedure that belongs in a skill, a lifecycle instruction that belongs in a hook); this release adds
+a hybrid deterministic + opus motor that surfaces those as opportunities, every finding citing a
+provenance-stamped best-practices register entry. Scanner count 14 → **15**, commands 18 → **20**,
+agents 6 → **7**.
+
+### Added
+- **Best-practices register (knowledge layer).** `knowledge/best-practices.json` — a provenance-stamped,
+  schema-validated register (each entry: `id` / `claim` / `confidence` / `source` + optional
+  `mechanism` / `lensCheck`), the first runtime-consumed file under `knowledge/` and the source of
+  truth for the optimization lens. Loaded/validated by `scanners/lib/best-practices-register.mjs`.
+  Only **confirmed** entries are user-facing (verification duty).
+- **Optimization-lens scanner (`CA-OPT`, scanner count 14 → 15).** New orchestrated scanner:
+  `CA-OPT-001` (LOW, *Missed opportunity*) — a CLAUDE.md procedure (≥6 consecutive numbered steps)
+  that would fit better as a skill, with recommendation + provenance from register entry `BP-MECH-003`.
+  Deterministic and conservative (no false positives on the negative corpus).
+- **`/config-audit optimize` + `optimization-lens-agent` (opus, agents 6 → 7).** The prose-judgment
+  half of the lens, for the cases the deterministic scanner deliberately skips: lifecycle phrasing →
+  hook (`BP-MECH-001`), unscoped path-specific instruction → rule (`BP-MECH-002`), absolute "never"
+  prohibition → permission (`BP-MECH-004`). A pre-filter (`scanners/lib/lens-prefilter.mjs`,
+  unit-tested) does cheap recall; the opus agent is the precision gate, dropping low-confidence
+  candidates and citing the register id + source for each kept one. Agent-driven → deliberately not
+  byte-stable (own command, outside the snapshot suite).
+- **`/config-audit knowledge-refresh` (commands 19 → 20).** Keeps the register current so the lens
+  never reads stale rules. A deterministic core (`scanners/lib/knowledge-refresh.mjs`, `assessFreshness`
+  with an **injected** reference date — it never reads the clock) classifies each entry fresh/stale by
+  the age of its `source.verified` stamp (default 90-day quarterly cadence); a read-only CLI
+  (`knowledge-refresh-cli.mjs`, `--reference-date` / `--stale-after` / `--dry-run`) reports staleness
+  without ever writing the register or hitting the network. The command layer re-verifies stale sources
+  (WebFetch) and polls the CC changelog + Anthropic blog (WebSearch), then applies **only
+  human-approved writes** (verification duty). Web/judgment-driven → deliberately not byte-stable.
+
+### Notes
+- **Byte-stability.** The new OPT scanner's additive entry is stripped at compare time
+  (`tests/helpers/strip-added-scanner.mjs`); the original 13-scanner `--json` / `--raw` output stays
+  byte-stable, and only the SC-5 default-output snapshots are regenerated (additive). The two
+  non-deterministic surfaces (`optimize`, `knowledge-refresh`) live outside the snapshot suite by
+  design. `-cli` / lib modules are not orchestrated scanners (self-audit excludes them), so the
+  scanner count stays **15**. Suite **1091** pass (hermetic HOME), self-audit A/A (config 94,
+  plugin 100), readmeCheck passed.
+
 ## [5.6.0] - 2026-06-20
 
 ### Summary