chore(catalog): remove llm-security and config-audit from the catalog

Both plugins move to the operator's private marketplace (decision
2026-10-06): their threat and Claude Code knowledge is out of date and
they will not be developed further in the open. Removed from the
manifest, the README and PUBLIC_REPOS in the same commit, as the
public-link gate requires. The catalog now lists 9 plugins.

check-public-links: 0 hits; check-versions, check-retired-refs,
check-nav-golden exit 0 before and after; 233 of 233 tests pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude-plugin/marketplace.json

@@ -10,24 +10,6 @@
     "version": "1.0.0"
   },
   "plugins": [
-    {
-      "name": "llm-security",
-      "source": {
-        "source": "url",
-        "url": "https://git.fromaitochitta.com/open/llm-security.git",
-        "ref": "v8.1.3"
-      },
-      "description": "Security scanning, auditing, and threat modeling for Claude Code projects. OWASP LLM Top 10 (2025) and Agentic AI Top 10."
-    },
-    {
-      "name": "config-audit",
-      "source": {
-        "source": "url",
-        "url": "https://git.fromaitochitta.com/open/config-audit.git",
-        "ref": "v6.0.0"
-      },
-      "description": "Multi-agent workflow for analyzing, reporting, and optimizing Claude Code configuration across your entire machine"
-    },
     {
       "name": "voyage",
       "source": {

README.md

@@ -63,37 +63,6 @@ propagates to `plugins/known_marketplaces.json` on the next start, and `false` p
 
 ## Plugins
 
-### [LLM Security](https://git.fromaitochitta.com/open/llm-security) `v8.1.3`
-
-Security scanning, auditing, and threat modeling for agentic AI projects. Built on OWASP LLM Top 10 (2025), OWASP Agentic AI Top 10, and Google DeepMind's AI Agent Traps taxonomy.
-
-- **Automated enforcement** — 9 hooks block prompt injection, secrets in code, destructive commands, and supply-chain risks in real time
-- **Deterministic scanning** — 22 Node.js scanners for entropy, Unicode codepoints, typosquatting, taint flow, git forensics, AI-BOM, trigger/signature/AST-taint, and IDE-extension prescan (VS Code + JetBrains)
-- **Advisory analysis** — 20 commands that scan, audit, and model threats with letter-graded reports and remediation
-- **Enterprise governance** — EU AI Act / NIST AI RMF / ISO 42001 mapping, SARIF 2.1.0 output, policy-as-code, standalone CLI
-
-Key commands: `/security posture`, `/security audit`, `/security scan`, `/security ide-scan`, `/security threat-model`
-
-22 scanners · [Full documentation →](https://git.fromaitochitta.com/open/llm-security)
-
----
-
-### [Config-Audit](https://git.fromaitochitta.com/open/config-audit) `v6.0.0`
-
-Configuration intelligence for Claude Code. Claude reads instructions from 7+ file types across multiple scopes; this plugin tells you what's wrong, what's missing, what's silently conflicting, what's actually loaded, and where you're burning tokens.
-
-- **Health** — 16 deterministic scanners catch broken imports, deprecated settings, conflicting rules, permission contradictions, plugin-hygiene collisions, and token waste
-- **Opportunities** — context-aware recommendations for Claude Code features you're not using
-- **Action** — auto-fix with mandatory backups, syntax validation, and rollback
-- **Inventory + hotspots** — read-only view of active plugins, skills, MCP servers, hooks, and CLAUDE.md cascade, plus a ranked map of token waste
-- **Plain-language UX** — output leads with prose and groups findings by impact and urgency (`--raw` and `--json` available)
-
-Key commands: `/config-audit posture`, `/config-audit feature-gap`, `/config-audit fix`, `/config-audit whats-active`, `/config-audit tokens`
-
-7 agents · 16 scanners · 21 commands · 1398 tests · [Full documentation →](https://git.fromaitochitta.com/open/config-audit)
-
----
-
 ### [Voyage](https://git.fromaitochitta.com/open/voyage) `v6.1.1`
 
 A six-command planning pipeline with specialized agent swarms, adversarial review, and zero-friction multi-session resumption. Renamed from `ultraplan-local`/`/ultra*-local` to avoid collision with Anthropic's `/ultraplan` and `/ultrareview`. No cloud dependency.

scripts/check-public-links.mjs

@@ -19,12 +19,10 @@ const HERE = dirname(fileURLToPath(import.meta.url));
 // Org repositories the catalog may link to — the published plugins plus this catalog.
 export const PUBLIC_REPOS = [
   'ai-psychosis',
-  'config-audit',
   'graceful-handoff',
   'human-friendly-style',
   'ktg-plugin-marketplace',
   'linkedin-studio',
-  'llm-security',
   'ms-ai-architect',
   'okr',
   'repo-mailbox',