fix(config-audit): expose hotspot.path for --accurate-tokens calibration + SC-6b PASS

The v5.0.0-rc.1 N5 implementation looked up hotspot.path in
calibrateAgainstApi() but token-hotspots.mjs only emitted hotspot.source —
calibration silently produced 0 actual_tokens because every iteration hit
the `if (!hotspot?.path) continue` guard.

Fix: file-backed hotspots now expose `path: h.absPath` in the JSON output.
MCP-server hotspots intentionally leave path unset — their tokens are
runtime tool-schema (formula-based: 500 + toolCount × 200), not file
content readable by count_tokens.

SC-6b release-gate verified against tests/fixtures/marketplace-large:
- Actual (count_tokens, claude-opus-4-7): 589 tokens for CLAUDE.md
- Estimated (4-bytes/token byte heuristic): 594 tokens
- Delta: -5 tokens / -0.85% — well within ±5% gate. PASS.

CHANGELOG: documented the fix + SC-6b result inline under [5.0.0].

All 635 tests still green. No estimateTokens tuning required for v5.0.0.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

plugins/config-audit/scanners/token-hotspots.mjs

@@ -245,12 +245,20 @@ async function buildHotspots(discovery, targetPath, activeConfig) {
   const out = [];
   for (let i = 0; i < top.length; i++) {
     const h = top[i];
-    out.push({
+    const entry = {
       source: h.relPath || h.absPath,
       estimated_tokens: h.estimated_tokens,
       rank: i + 1,
       recommendations: hotspotRecommendations(h),
-    });
+    };
+    // Expose the on-disk path for file-backed hotspots so the
+    // --accurate-tokens calibration in token-hotspots-cli can read content.
+    // MCP-server hotspots are virtual (runtime tool-schema, not file content)
+    // so their path stays unset and calibration skips them.
+    if (h.type !== 'mcp-server' && h.absPath) {
+      entry.path = h.absPath;
+    }
+    out.push(entry);
   }
 
   return out;