feat(config-audit): TOK flags skill description > 500 chars (v5 M2) [skip-docs]

- New Pattern F in TOK: low-severity finding when SKILL.md description > 500 chars
- Scoped to discovery.files (project-local) — activeConfig.skills walk would
  pull in user/plugin skills out of project scope
- New fixtures: skill-bloated (594-char desc) + skill-tight (46-char baseline)

574 → 576 tests, all green.

plugins/config-audit/tests/scanners/token-hotspots.test.mjs

@@ -189,6 +189,22 @@ describe('TOK scanner — hotspots contract', () => {
   });
 });
 
+describe('TOK scanner — M2 skill description > 500 chars (v5)', () => {
+  it('flags skill with bloated description (low severity)', async () => {
+    const result = await runScanner('skill-bloated');
+    const f = result.findings.find(x => /skill description/i.test(x.title || ''));
+    assert.ok(f, `expected skill-description finding; got: ${result.findings.map(x => x.title).join(' | ')}`);
+    assert.equal(f.severity, 'low', `expected low, got ${f.severity}`);
+    assert.match(f.evidence || '', /bloated/);
+  });
+
+  it('does NOT flag tight description (under 500 chars)', async () => {
+    const result = await runScanner('skill-tight');
+    const f = result.findings.find(x => /skill description/i.test(x.title || ''));
+    assert.equal(f, undefined, `expected no skill-description finding; got: ${f?.title}`);
+  });
+});
+
 describe('TOK scanner — M4 cascade > 10k tokens (v5)', () => {
   it('flags CLAUDE.md cascade > 10k tokens with medium severity', async () => {
     const result = await runScanner('large-cascade');