chore(catalog): remove llm-security and config-audit from the catalog

Both plugins move to the operator's private marketplace (decision
2026-10-06): their threat and Claude Code knowledge is out of date and
they will not be developed further in the open. Removed from the
manifest, the README and PUBLIC_REPOS in the same commit, as the
public-link gate requires. The catalog now lists 9 plugins.

check-public-links: 0 hits; check-versions, check-retired-refs,
check-nav-golden exit 0 before and after; 233 of 233 tests pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/check-public-links.mjs

@@ -19,12 +19,10 @@ const HERE = dirname(fileURLToPath(import.meta.url));
 // Org repositories the catalog may link to — the published plugins plus this catalog.
 export const PUBLIC_REPOS = [
   'ai-psychosis',
-  'config-audit',
   'graceful-handoff',
   'human-friendly-style',
   'ktg-plugin-marketplace',
   'linkedin-studio',
-  'llm-security',
   'ms-ai-architect',
   'okr',
   'repo-mailbox',