docs(llm-security): trim README badge row 8 -> 4 (repo-standard BADGE-COUNT)

repo-standard v0.2.0 flagged two README findings via coord. Verified both
against ground truth before acting:

- BADGE-COUNT (WARN, real): 8 badges confirmed by manual count. All eight
  numbers were accurate -- commands 20, agents 6, hooks 9, knowledge 23,
  scanners 22 (27 top-level .mjs minus the 5 non-scanner modules, per the
  counting rule in docs/scanner-reference.md). The finding is about clutter,
  not staleness. Operator chose to keep Version, Platform, Scanners, License
  and drop the four inventory badges (Commands/Agents/Hooks/Knowledge) --
  each of those repeats a table further down the same page and adds a sync
  obligation to every version bump.

- README-H1 (WARN, operator's call): no change. The H1 is the human-readable
  product title; llm-security is the package id in plugin.json and the
  catalog. Renaming the H1 to the slug would be a readability regression.

doc-consistency.test.mjs pinned two of the removed/kept badges. The scanners
assertion still holds; the knowledge_docs badge assertion is dropped and the
test narrowed to the README prose claims, which remain derived from
knowledge/ contents. Full suite 2034/2034.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016h37aUdBLVDT9xrvG9osA9

README.md

@@ -8,11 +8,7 @@ Security scanning, auditing, and threat modeling for Claude Code projects. OWASP
 
 ![Version](https://img.shields.io/badge/version-7.8.3-blue)
 ![Platform](https://img.shields.io/badge/platform-Claude_Code_Plugin-purple)
-![Commands](https://img.shields.io/badge/commands-20-orange)
-![Agents](https://img.shields.io/badge/agents-6-orange)
 ![Scanners](https://img.shields.io/badge/scanners-22-cyan)
-![Hooks](https://img.shields.io/badge/hooks-9-red)
-![Knowledge](https://img.shields.io/badge/knowledge_docs-23-green)
 ![License](https://img.shields.io/badge/license-MIT-lightgrey)
 
 A Claude Code plugin that provides security scanning, auditing, and threat modeling for agentic AI projects. Built on [OWASP LLM Top 10 (2025)](https://genai.owasp.org/llm-top-10/), [OWASP Agentic AI Top 10 (ASI01-ASI10, 2026 edition)](https://genai.owasp.org/agentic-ai/), OWASP Skills Top 10 (AST01-AST10), MCP Top 10, and the [AI Agent Traps](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6372438) taxonomy (Google DeepMind, 2025), grounded in published research from ToxicSkills, ClawHavoc, MCPTox, Pillar Security, Invariant Labs, GHSL Security Lab, and Operant AI.

tests/lib/doc-consistency.test.mjs

@@ -335,16 +335,11 @@ describe('doc-consistency — inventory counts are derived from source (B10)', (
   });
 
   // -- Knowledge-file count --------------------------------------------------
-  it('README knowledge badge and prose match knowledge/ contents', () => {
+  // The knowledge_docs badge was dropped in the badge-row trim (repo-standard
+  // BADGE-COUNT); only the prose claims remain to keep in sync.
+  it('README prose knowledge counts match knowledge/ contents', () => {
     const expected = knowledgeFileCount();
     const content = readFileSync(join(PLUGIN_ROOT, 'README.md'), 'utf-8');
-    const badge = content.match(/badge\/knowledge_docs-(\d+)-/);
-    assert.notEqual(badge, null, 'README.md has no `knowledge_docs-<N>` badge');
-    assert.equal(
-      Number(badge[1]),
-      expected,
-      `README knowledge badge says ${badge[1]} but knowledge/ holds ${expected} files.`,
-    );
     for (const m of content.matchAll(/(\d+)\s+knowledge files/g)) {
       assert.equal(
         Number(m[1]),