test(v8.1.3): red tests for plan points 1, 2, 3, 5 and addenda a-c

Each test fails on fd7de23:
- own-working-tree: venv site-packages, vendor/, config-dir skills/
  (punkt 1); ~/.claude/plugins next to $CLAUDE_CONFIG_DIR and a leading
  ~ in the variable (punkt 2); NODE_MODULES case variant and a
  case-mismatched parent segment (punkt 3, closes v8.1.2 punkt 4).
- watch-cron-scope: a watched project's own ignore file is honored
  (punkt 5).
- av-surface (b2): no runnable base64-to-shell line with a short
  command blob (addendum a; 3 hits today).
- doc-consistency: scanner-reference Knowledge Files matches knowledge/
  (addendum b); ci-cd-guide makes no offline claim (addendum c).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/lib/doc-consistency.test.mjs

@@ -349,6 +349,20 @@ describe('doc-consistency — inventory counts are derived from source (B10)', (
     }
   });
 
+  // v8.1.3 (tillegg b): scanner-reference.md said "Knowledge Files (20)" while
+  // knowledge/ held 22 — the header and the table must both follow the dir.
+  it('docs/scanner-reference.md Knowledge Files header and table match knowledge/', () => {
+    const files = readdirSync(KNOWLEDGE_DIR).sort();
+    const content = readFileSync(join(PLUGIN_ROOT, 'docs', 'scanner-reference.md'), 'utf-8');
+    const header = content.match(/^## Knowledge Files \((\d+)\)$/m);
+    assert.notEqual(header, null, 'scanner-reference.md has no `## Knowledge Files (N)` header');
+    assert.equal(Number(header[1]), files.length,
+      `scanner-reference.md says Knowledge Files (${header[1]}) but knowledge/ holds ${files.length}.`);
+    const rows = [...content.slice(header.index).split('\n## ')[0].matchAll(/^\| `([^`]+)` \|/gm)]
+      .map(m => m[1]).sort();
+    assert.deepEqual(rows, files, 'the Knowledge Files table must list exactly the files in knowledge/');
+  });
+
   // -- output.mjs finding() prefix list --------------------------------------
   it('output.mjs JSDoc lists every prefix passed to finding()', () => {
     const actual = findingPrefixes();
@@ -411,3 +425,24 @@ describe('doc-consistency — inventory counts are derived from source (B10)', (
     );
   });
 });
+
+// v8.1.3 (tillegg c): docs/ci-cd-guide.md said the standalone CLI makes zero
+// network calls and that OSV is opt-in. The orchestrated scanners run
+// `npm audit` and `pip-audit` (dep), resolve domains over DNS (network) and
+// query OSV.dev (supply-chain), with no switch to turn any of them off —
+// README says so since the v8.1.2 README rewrite.
+describe('doc-consistency — ci-cd-guide tells the truth about network calls (v8.1.3)', () => {
+  const content = readFileSync(join(PLUGIN_ROOT, 'docs', 'ci-cd-guide.md'), 'utf-8');
+
+  it('makes no offline claim', () => {
+    for (const claim of [/zero network calls/i, /no external API calls/i, /OSV\.dev queries \(opt-in\)/i, /no cross-border data transfer/i]) {
+      assert.equal(claim.test(content), false, `ci-cd-guide.md still claims ${claim}`);
+    }
+  });
+
+  it('names every network path the CLI takes', () => {
+    for (const path of [/npm audit/, /pip-audit/, /DNS/, /OSV\.dev/]) {
+      assert.match(content, path, `ci-cd-guide.md does not name ${path}`);
+    }
+  });
+});