feat(config-audit): self-audit --check-readme flag (v5 F6) [skip-docs]

Filesystem counts are the source of truth; README badges parsed via
line-anchored substring (badge/<kind>-<N>-...). Emits readmeCheck object
with counts/badges/mismatches.

CLI: node scanners/self-audit.mjs --check-readme [--json]
API: runSelfAudit({ checkReadme: true }) → result.readmeCheck
Helper: checkReadmeBadges(pluginDir) for per-fixture testing

New fixture: readme-desynced/ (commands/foo + bar, README claims 1).

Note: alpha phase does NOT require result.readmeCheck.passed === true.
Self-test of real plugin currently fails (scanners 10 vs 9, tests 31 vs 543);
will be reconciled in Session 5 Step 28 (README sync).

582 → 586 tests, all green.

plugins/config-audit/tests/fixtures/readme-desynced/README.md

@@ -0,0 +1,7 @@
+# readme-desynced fixture
+
+Fixture for v5 F6 self-audit --check-readme. The badge below claims 1 command,
+but `commands/` actually contains 2 (foo, bar). The check should flag this as
+a low-severity mismatch.
+
+![Commands](https://img.shields.io/badge/commands-1-green)

plugins/config-audit/tests/fixtures/readme-desynced/commands/bar.md

@@ -0,0 +1,6 @@
+---
+name: bar
+description: Bar command for the readme-desynced fixture
+---
+
+# Bar command body

plugins/config-audit/tests/fixtures/readme-desynced/commands/foo.md

@@ -0,0 +1,6 @@
+---
+name: foo
+description: Foo command for the readme-desynced fixture
+---
+
+# Foo command body