docs(config-audit): add v4.0.0 CHANGELOG entry

Document the Opus 4.7 era upgrade: TOK scanner, /config-audit tokens,
Token Efficiency 8th area, scanner/verifier agent migration to sonnet.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

plugins/config-audit/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.0.0] - 2026-04-19
+
+### Summary
+Opus 4.7 era upgrade. New TOK scanner detects token-efficiency anti-patterns (cache-breaking volatile content, redundant tool permissions, deep import chains, sonnet-era minimal setups). Token Efficiency joins the quality scorecard as the 8th area. Scanner-agent and verifier-agent migrate from haiku → sonnet per global no-haiku policy.
+
+### Added
+- **`token-hotspots.mjs`** scanner (CA-TOK-001..004) — 4 patterns aligned with Opus 4.7 token-cost dynamics:
+  - CA-TOK-001 cache-breaking volatile content (timestamps/UUIDs in top 30 lines of CLAUDE.md)
+  - CA-TOK-002 redundant tool permissions (duplicate or subset overlaps)
+  - CA-TOK-003 deep @import chains (>2 hops on the load path)
+  - CA-TOK-004 sonnet-era minimal setup (no skills/MCP/hooks/managed/plugins)
+- **`/config-audit tokens [path] [--global]`** — ranked hotspot table + per-pattern findings.
+- **`scanners/token-hotspots-cli.mjs`** — standalone CLI emitting `total_estimated_tokens`, `hotspots`, and per-finding output.
+- **Token Efficiency** as the 8th quality area in the posture scorecard (now 9 scanners total: CML/SET/HKV/RUL/MCP/IMP/CNF/GAP/TOK).
+- `id` field on every area in the scorecard payload (`token_efficiency`, `instruction_clarity`, etc.) for stable downstream lookup.
+- 13 new TOK scanner tests + 3 CLI tests + posture grade-stability test for `token_efficiency`.
+- Knowledge refresh: `knowledge/opus-4.7-patterns.md`, plus 2026-04 deltas (v2.1.83–v2.1.111) added to `feature-evolution.md`, `claude-code-capabilities.md`, and `hook-events-reference.md` from `research/03-claude-code-changes-config-surfaces.md`.
+
+### Changed
+- **BREAKING (additive surface):** Quality areas count 7 → 8. Posture JSON consumers that hard-coded 7 areas must update.
+- **BREAKING (model migration):** `scanner-agent` and `verifier-agent` migrated `haiku` → `sonnet`. Latency and cost trade-offs accepted; deterministic scanner CLIs preferred over agent invocations.
+- Scanner count: 8 → 9 (TOK added).
+- Command count: 16 → 17 (`/config-audit tokens` added).
+- Version bump: `3.1.0` → `4.0.0`.
+
 ## [3.1.0] - 2026-04-14
 
 ### Summary