fix(config-audit): remove TOK dead take + hotspot padding (v5 F4)

The buildHotspots padding loop and unused 'take' variable were dead
code from the v3 hotspots-min contract. Replaced with a clean
ranked.slice(0, HOTSPOTS_MAX). Tiny fixtures may now return fewer
than 3 hotspots, which is the honest answer; the contract now only
asserts <= 10.

Tests: +2 cases — every hotspot.source is unique (no padding); length
never exceeds HOTSPOTS_MAX.

plugins/config-audit/tests/scanners/token-hotspots.test.mjs

@@ -170,4 +170,16 @@ describe('TOK scanner — hotspots contract', () => {
         `hotspot.recommendations length should be 1–3, got ${h.recommendations.length}`);
     }
   });
+
+  it('every hotspot.source is unique (v5 F4: no padding)', () => {
+    const sources = result.hotspots.map(h => h.source);
+    const unique = new Set(sources);
+    assert.equal(unique.size, sources.length,
+      `expected unique sources; got duplicates in: ${sources.join(', ')}`);
+  });
+
+  it('hotspots.length never exceeds HOTSPOTS_MAX (10)', () => {
+    assert.ok(result.hotspots.length <= 10,
+      `expected ≤10 hotspots, got ${result.hotspots.length}`);
+  });
 });