knowledge: video-digest reads its dependency directory only from an environment variable the Bash tool never carries, so its pipeline and preflight fail before any digest work

[kyle-sexton]

Severity: high (auditor-suggested, uncalibrated)
Component: knowledge:video-digest (source at worktree HEAD 0c5fd28; version 0.15.2). The worktree moved to f9cc202 (0.15.3) during review; that diff changes none of the cited code or text, but SKILL.md lines after 124 sit 3 to 6 lines lower there.
Readiness: mixed: E1, E3, I3 agent-ready (recommendations); E2, I1, I2, Q1, Q2, S2 needs-decision
Duplicates: none found; Related: #5835 (open): its A2 prerequisites contract plans a /<plugin>:check per plugin and a shared checker, which would cover I3 and the E3 script; #5803 (closed): earlier video-digest pipeline fixes, different defects; #5846 (closed): rendered-views routing for video-digest; #5802 (closed): parent of #5803.

Summary

An unattended subagent ran /knowledge:video-digest on an X video post in an auto-mode,
worktree-isolated session. The skill's ! preflight was refused by the worktree command-shape
check, the node pipeline never ran, and the agent hand-ran yt-dlp, ffmpeg and ImageMagick, so none
of the skill's contract outputs exist. The skill's own defects: every pipeline script and the
preflight probe read the data directory from process.env.CLAUDE_PLUGIN_DATA, which the Bash tool
never carries, so the pipeline cannot install or load its dependencies from any session (E1); the
preflight is a compound block with no allowed-tools entry and no fallback (E3); and every
${user_config.*} option sits in spoke files that arrive unsubstituted (E2). A separate cause is
the operator's brief, which forbade home-folder writes; it explains why the agent never tried
setup-deps.mjs, and the skill offered no other install location and no stop for that case (I1,
I2). Fixing E1 and E3 makes every documented action runnable from the Bash tool and gives a
truthful readiness report.

Findings

E1. The pipeline cannot find its own data directory from the Bash tool

• Severity: high Status: recommendation (tier-1, primary https://code.claude.com/docs/en/plugins/manifest-reference)
• What happened: not observed in the evidence run (the preflight never ran and setup-deps was not attempted); reproduced instead. printenv CLAUDE_PLUGIN_DATA CLAUDE_PLUGIN_ROOT CLAUDE_PROJECT_DIR CLAUDE_SKILL_DIR in the Bash tool exits 1 with all four unset, in the audit session and again in this review's subagent on 2.1.288 (sources/seam-reproduction-2026-10-02.txt). The preflight's own node probe prints MISSING with the variable unset and installed when the same probe is given CLAUDE_PLUGIN_DATA pointing at a fixture holding the package (audit-notes.md E1). The data dir exists and is empty (raw/plugin-data-listing.txt).
• Why: extraction/setup-deps.mjs:25-32 exits 1 with "CLAUDE_PLUGIN_DATA is not set" before writing anything; extraction/resolve-hook.mjs:16-18 sets dataModules = null, so bare @melodic/* imports fail even after an install; SKILL.md:14 probes process.env.CLAUDE_PLUGIN_DATA; extraction/run.mjs:67-71 passes process.env to the child and lib/run-args.js has no data-dir flag. SKILL.md substitutes ${CLAUDE_PLUGIN_ROOT} into script paths but never passes ${CLAUDE_PLUGIN_DATA}. No node_modules exists anywhere in the checkout to satisfy the imports otherwise.
• Options, cheapest first: 1. Add a data-dir flag to setup-deps.mjs and run.mjs (run.mjs forwards it to the child as CLAUDE_PLUGIN_DATA, so resolve-hook.mjs keeps working), named as rung 1 of the on-demand-dependencies convention's "Finding the plugin data directory" (--deps-dir in its inventory example, --data-dir in its Python section), and pass "${CLAUDE_PLUGIN_DATA}" on every SKILL.md invocation, where Claude Code substitutes it at load. 2. Replace the preflight's environment read with the same substituted path (E3 option 1). 3. Implement the convention's full resolution order (S2).
• Scope check: needs to exist, since no documented action (transcript, queue, watch, resume) can load its dependencies. Option 1 is the smallest change; option 3 can follow.

E2. Every knowledge userConfig option is a silent no-op for video-digest

• Severity: high (review suggests medium) Status: needs-decision
• What happened: the evidence agent's Read of reference/sources/x.md returned the literal text "Supply ${user_config.yt_dlp_cookies_file}" (raw/transcript-user-config-token.md, transcript line 57).
• Why: SKILL.md contains no ${user_config.*} reference. All 15 lines that carry one are in spokes the model opens with the Read tool (context/output-contract.md:17-24 and :44-46, reference/sources/youtube.md:52-69, reference/sources/x.md:190), which return file bytes. output-contract.md:44-46 treats a token that is "still an unexpanded token" as the default, so a configured library_dir is ignored without a warning and artifacts land at the repo root; the cookie, js-runtime and concurrency options never reach run.mjs. Claude Code documents ${user_config.KEY} substitution in skill content, "Anywhere in the Markdown body" (manifest-reference lines 494 and 574). The sibling skills docpage-digest and map-corpus render library_dir in their SKILL.md body. Confound: that option's default is the empty string, and nothing in the packet shows how an empty option renders even in a SKILL.md body, so the observation alone does not separate the two causes; the source-level defect stands either way.
• Options, cheapest first: 1. Add a short block to the SKILL.md body that renders each option once (library_dir: ${user_config.library_dir} and the four yt-dlp and concurrency options), and have the spokes refer to the rendered value instead of the token. 2. Remove the "unexpanded token means default" rule at output-contract.md:44-46, so an unexpanded token is reported as a bug. 3. An eval case that sets library_dir and asserts --work-root reaches run.mjs.
• Scope check: needs to exist for any user who sets an option; defaults are unaffected. Option 1 is the smallest change.

E3. The ! preflight cannot run as written in an auto-mode worktree session, and names no fallback

• Severity: medium-high Status: recommendation (tier-1, primary https://code.claude.com/docs/en/skills)
• What happened: the harness did not run the block at render; it rendered "[run this first, exactly as written, and use its output:]" (raw/transcript-deps-preflight.md line 14, transcript line 17). Claude's Bash call with the exact text was refused: "this command is too complex to verify that it stays inside the worktree. Refusing to run it" (line 31, transcript line 27). No prerequisite report printed, and the agent probed tools one at a time.
• Why: SKILL.md:13-18 is four brace groups with command -v, pipes and || chains; the frontmatter has no allowed-tools; the skill says nothing about a refused preflight. Even when it runs, its node line is always MISSING (E1). Outside auto mode, an injected command no rule allows aborts the whole invocation (skills.md line 729, and independently #97476 on 2.1.281); that branch was not reproduced here.
• Options, cheapest first: 1. Replace the block with one plain command that runs a script by path and takes the data dir as an argument, for example node "${CLAUDE_SKILL_DIR}/extraction/check-prereqs.mjs" --data-dir "${CLAUDE_PLUGIN_DATA}"; the script probes the node deps, yt-dlp, ffmpeg, ImageMagick and the faster-whisper import and always exits 0. Whether that shape passes the worktree command-shape check is untested; check it before relying on it. 2. Pre-approve exactly that command in frontmatter allowed-tools, where the same variables are substituted, so it runs at render in default mode. 3. One line under Prerequisites: if the pre-computed context did not run, run that command yourself before Bootstrap.
• Scope check: needs to exist. Option 1 also fixes E1's probe; options 2 and 3 are one line each.

I1. No stop or degraded path at the Bootstrap gate when the node pipeline cannot run

• Severity: medium Status: needs-decision
• What happened: the agent did not stop. It hand-ran the tools and produced none of run-state/watch.json, the README stub, research/claim-inventory.md, the research stage or recommendations/ (raw/handback-video.md problem 1; raw/slice-listing.txt). The hand path skipped captions+repair (x.md:122-123) and lost the captionRung and transcriptStrategy provenance run-transcript.js:104-112 emits; the handback reports "Cloud Code" for "Claude Code" throughout (whether repair would have fixed it is unverified).
• Why: the Bootstrap gate (SKILL.md:119-120) STOPs only on MISSING yt-dlp, ffmpeg or ImageMagick, and its node step is "Run setup-deps.mjs" with no failure branch. SKILL.md:216 does say "If any prerequisite fails, stop and inform the user", so the two instructions disagree on node deps, and nothing says a hand-run of the tools is not this skill's output. Separate cause: the operator's brief forbade the home-folder write setup-deps needs and asked the agent to report missing tools; continuing by hand was the agent's choice.
• Options, cheapest first: 1. Add node deps to the Bootstrap STOP list, printing setup-deps' failure text, and state that a hand-run of yt-dlp is not this skill's output. 2. Define a degraded mode in context/watch-pipeline.md: README from templates/readme-journey.md with pipeline: not-run, a transcript header naming the caption class (platform-asr) and repair: not-applied, slice status: partial.
• Scope check: option 1 needs to exist and is one line; option 2 is optional.

I2. No operator override for where the node dependencies install

• Severity: medium Status: needs-decision
• What happened: under the operator's no-home-folder rule the only install target, ~/.claude/plugins/data/knowledge-melodic-software/, was off-limits and stayed empty (raw/plugin-data-listing.txt; raw/handback-video.md problem 1).
• Why: setup-deps.mjs:25,34,78-81 and resolve-hook.mjs:16 take the base only from the environment; there is no flag or option. The convention's .work/ rung for a marketplace checkout would have satisfied this session, because the plugin ran from the main checkout.
• Options, cheapest first: 1. The E1 flag doubles as the override; document it under Prerequisites with one line on when to use it. 2. Implement the convention's full order and print which rule chose the base.
• Scope check: covered by E1 option 1 plus one documentation line.

I3. The read-only prerequisite check exists but the model cannot reach it, and the skill never routes to it

• Severity: low-medium Status: recommendation (tier-1, primary https://code.claude.com/docs/en/skills)
• What happened: the evidence session got no readiness report and found its prerequisites by hand (raw/handback-video.md). /knowledge:setup check probes the same tools read-only, but a subagent cannot invoke it: this review's Skill-tool call to knowledge:setup from a subagent was refused with "cannot be used with Skill tool due to disable-model-invocation" (sources/seam-reproduction-2026-10-02.txt).
• Why: skills/setup/SKILL.md:5 sets disable-model-invocation: true; there is no plugins/knowledge/skills/check/ (25 plugins in this repo ship one); video-digest's failure text (SKILL.md:216-217) routes only to setup-deps.mjs. docs/plugin-philosophy.md:595-600 requires a separate check skill when a hook or probe names a read-only check; video-digest's probe names none, so this is a gap, not a violation.
• Options, cheapest first: 1. Route video-digest's Prerequisites failure line to the E3 script. 2. Add plugins/knowledge/skills/check/SKILL.md in the context7 shape (reads setup, follows only its check section, disable-model-invocation: false). 3. Add faster-whisper detection to setup's check as an INFO row.
• Scope check: option 2 adds little for video-digest once E3 option 1 lands, and Epic: comprehension family, prerequisites contract and shared-code amendment #5835 plans a per-plugin check; option 1 is the smallest change.

Q1. The skill installs into the home data directory without first saying what and where

• Severity: low-medium Status: needs-decision
• What happened: the agent had to read setup-deps.mjs to learn the install target and contents (raw/transcript-deps-preflight.md lines 40-99, transcript lines 45-48).
• Why: the Bootstrap gate runs the install unconditionally (SKILL.md:119), and skills/setup/SKILL.md:45 says "each ingest skill self-provisions on first run"; nothing names the target (~/.claude/plugins/data/<id>/node_modules) or that it pulls the vendored packages and their registry dependencies.
• Options, cheapest first: 1. Have the E3 script print the resolved install path and "will install on first watch/transcript run; pass the data-dir flag to relocate". 2. State the same in Prerequisites item 1.
• Scope check: one printed line; no separate change needed beyond E3.

Q2. setup-deps' failure message points the user the wrong way

• Severity: low Status: needs-decision
• What happened: with the variable unset, as reproduced under E1, setup-deps.mjs prints "Run this inside Claude Code with the knowledge plugin installed." to a user who is already inside Claude Code with the plugin installed.
• Why: extraction/setup-deps.mjs:29.
• Options, cheapest first: 1. Name the cause and the fix, for example "no data directory: pass the data-dir flag (the skill body passes ${CLAUDE_PLUGIN_DATA})".
• Scope check: one string.

S2. Data-directory resolution reads only the environment (on-demand-dependencies convention)

• Severity: standards Status: needs-decision
• What happened: the consequence is E1 (reproduced there).
• Why: docs/conventions/on-demand-dependencies/README.md:59 orders an explicit flag, then $CLAUDE_PLUGIN_DATA accepted only when its last path segment names the plugin, then the marketplace checkout's .work/, then <config dir>/plugins/data/<plugin>-<marketplace>/. setup-deps.mjs:25 and resolve-hook.mjs:16 implement only the environment rung, without the plugin-name check. Without that check, a session environment that holds another plugin's data dir (a hook can persist it, anthropics/claude-code #60057; the convention records the same observation) would send the install there.
• Options, cheapest first: 1. As E1 option 1 plus I2. 2. The full order (E1 option 3).
• Scope check: covered by E1.

Open questions for maintainers

1. E2 fix and severity. Decide how the options reach the pipeline: render them once in the SKILL.md body (suggested default) or another route; and whether E2 is high (auditor) or medium (review: defaults are unaffected). A one-step check closes the confound: set a non-default library_dir and confirm the spoke still shows the token in a skill run. Unblocks: configured library_dir, cookies, js-runtime and concurrency taking effect.
2. I1 shape. Options: a STOP line only (suggested default) or a defined degraded mode with status: partial. Unblocks: predictable output when the pipeline cannot run.
3. I2 and S2 scope. Options: the E1 data-dir flag only (suggested default) or the convention's full resolution order now. Unblocks: operators who cannot write under ~/.claude, and the wrong-plugin case.
4. Q1 and Q2 wording. Options: fold both into the E3 script's output and setup-deps' message (suggested default) or document them under Prerequisites. Unblocks: a user learning where the install goes and how to relocate it.
5. Research bar for E1, E3 and I3. They are recommendations under the audit's rule (primary plus two independent corroborators). The research skill's verifier graded all researched claims MEDIUM, because its bar counts only corroborators measured on the exact version and 2.1.288 shipped on the fetch date, so every third-party report is from an earlier 2.1 build. Options: accept them as recommendations (suggested default; the vendor page fetched that day and this review's own 2.1.288 runs agree) or hold them at needs-decision until a 2.1.288 third-party report exists. Unblocks: agent pickup of E1, E3, I3.
6. I3 versus Epic: comprehension family, prerequisites contract and shared-code amendment #5835. Options: route the failure line to the E3 script now and leave the check skill to Epic: comprehension family, prerequisites contract and shared-code amendment #5835's A2 (suggested default), or add knowledge:check now. Unblocks: a model-reachable readiness check.

Research

All fetches 2026-10-02 (rung-1 curl of the .md for vendor pages; GitHub REST API JSON for issues; saved under sources/).

E1:

• Tier 1, primary: https://code.claude.com/docs/en/plugins/manifest-reference.md, line 576, the variables are not in the Bash tool's environment, main session or subagent; skill content substitutes ${...} inline. Supports.
• Tier 2: CLAUDE_PLUGIN_ROOT unset in agent Bash env, and still source-dir in hooks, for string-source local marketplace plugins (2.1.265) anthropics/claude-code#93057 (third-party reproduction on 2.1.265, open): no CLAUDE_PLUGIN_ROOT and no CLAUDE_PLUGIN_DATA in the agent Bash tool, main session and a plugin-defined subagent. Supports.
• Tier 2: Plugin subagents can't resolve ${CLAUDE_PLUGIN_ROOT}/${CLAUDE_PROJECT_DIR} — no way to read plugin-bundled files from a subagent anthropics/claude-code#65768 (another reporter, 2.1.166, closed not-planned): echo "$CLAUDE_PLUGIN_ROOT" empty in a command's Bash env. Supports.
• Tier 0: this review's printenv in a subagent's Bash tool on 2.1.288, exit 1. Supports.
• Tier 1: https://code.claude.com/docs/en/changelog.md, latest 2.1.288 (2026-10-02); no entry changes this. Neutral (recency).
• Dissent: CLAUDE_PLUGIN_ROOT inconsistent between hooks/skills and agent environment for local marketplace plugins anthropics/claude-code#38699 (2.1.83) reported CLAUDE_PLUGIN_ROOT present in the agent Bash env; CLAUDE_PLUGIN_DATA is unnamespaced — plugins persisting it via CLAUDE_ENV_FILE pollute other plugins and skills anthropics/claude-code#60057 shows a hook can persist the variable through CLAUDE_ENV_FILE, which explains it. Historical.
• Not counted: the auditor's two corroborators, this repository's on-demand-dependencies and permission-rule-hygiene conventions, restate the primary page and are not independent; they were replaced.

E3:

• Tier 1, primary: https://code.claude.com/docs/en/skills.md, line 731 (auto mode hands the command to Claude), line 729 (abort outside auto mode; pre-approve with allowed-tools). Supports.
• Tier 1: https://code.claude.com/docs/en/worktrees.md line 93 and https://code.claude.com/docs/en/errors.md line 4501 (the command-shape refusal, also without git in the text). Support; same publisher, each a different leg.
• Tier 2: [FEATURE] Expose the plugin version to plugin skills as ${CLAUDE_PLUGIN_VERSION} anthropics/claude-code#97476 (third party, 2.1.281): an injected command without an allowed-tools entry aborts the invocation outside auto mode. Supports.
• Tier 0: the evidence transcript, lines 17, 26-27 (raw/transcript-deps-preflight.md). Supports.

I3:

• Tier 1, primary: https://code.claude.com/docs/en/skills.md, line 842: set disable-model-invocation: true to keep Claude from invoking the skill through the Skill tool. Supports.
• Tier 2: [Bug] Skill tool cannot invoke disable-model-invocation skills anthropics/claude-code#93761 (2.1.269, the same refusal text) and [Bug] Skills with disable-model-invocation: true are silently ignored when invoked via agent prompts anthropics/claude-code#77795 (2.1.210, a subagent cannot load such a skill). Support.
• Tier 0: this review's Skill-tool call to knowledge:setup from a subagent on 2.1.288, refused. Supports.

E2 was researched and not tiered: the vendor page states the mechanism, not the supporting-file case, and the one independent source (anthropics/claude-code#75208, 2.1.202) predates 2.1.288.

Research-skill verdict for all of the above: verification: fail rows 4 (research-verifier, 2026-10-02), all claims MEDIUM (see open question 5).

Review seams

• skill-quality:check: run by the audit session; PASS, 0 errors, 3 warnings (raw/skill-quality-check.txt).
• Research (discovery:research): used once, inline because the caller is a subagent; sibling verifier dispatched for rows 4, 7, 12.
• Breadth review: fell back; review:fanout and review:quality-gate review diffs, not a findings ledger. Structured self-review in seam-review.md.
• Adversarial: fell back; no dedicated skill; each finding re-derived from its artifact and the source.
• Upstream conformance: fell back; grep -F of every quoted harness span against the saved page, a re-check of the auditor's reads, not an independent conformance skill. All spans found at the cited lines.
• Adaptation chapter: used (Opus 5.5); no suggested change conflicts with it.
• Scope challenge: fell back; one line per change, recorded in each finding's scope check.

Adversarial disagreements (severities stand as uncalibrated):

1. E2: high is overstated; every option value in the evidence session was a default, so the defect is latent until a user configures one. Suggest medium.
2. I1: "no defined stop" overstates it; SKILL.md:216 already says stop on any failed prerequisite. The gap is the Bootstrap gate's narrower STOP list and the missing "a hand-run is not this skill's output" line.
3. E3: its three vendor pages share one publisher and document different legs, so they do not corroborate each other; the session transcript and #97476 are the independent support.
4. E1: the setup-deps exit needs no live run (the branch is unconditional when the variable is unset); the import failure is still read from source, not observed.
5. I3: likely subsumed by E3 option 1 for this skill and by Epic: comprehension family, prerequisites contract and shared-code amendment #5835 for the plugin.

Evidence

• Packet: /home/kyle/worktrees/melodic-software-claude-code-plugins-feat-5778-mod-conventions/.work/plugin-quality/evidence/f5c77f0d-9bcd-492e-a773-1fa651e926a0/knowledge-video-digest/20261002T233255Z/ (audit-notes.md, audit-notes-2.md, seam-review.md, contract.md, evidence.md).
• Key raw files: raw/transcript-deps-preflight.md, raw/transcript-user-config-token.md, raw/handback-video.md, raw/slice-listing.txt, raw/plugin-data-listing.txt, raw/spawn-brief-video.md, raw/skill-quality-check.txt; sources/seam-reproduction-2026-10-02.txt.
• Transcript: /home/kyle/.claude/projects/-home-kyle-worktrees-melodic-software-claude-code-plugins-feat-5778-mod-conventions/f5c77f0d-9bcd-492e-a773-1fa651e926a0/subagents/agent-af930ae4d4082e19a.jsonl.
• Environment: Claude Code 2.1.288, WSL2, zsh; auto mode; worktree-isolated session; skill loaded from the main checkout.
• Operator constraint: the dispatching brief forbade home-folder writes and system-wide installs (raw/spawn-brief-video.md); findings above are limited to what the skill controls.
• Blindspot (not a finding): course-digest appears to share E1 (its preflight and setup-deps read only the environment); not audited here.
• Candidates without a session artifact are kept in the packet's contract.md and are not part of this item.
• Produced by an unattended audit; nothing in it was confirmed by a human.

[kyle-sexton]

This was generated by AI during triage.

Triage

Outcome: human-gated, needs-decision. Priority medium (auditor severity: high, uncalibrated). Work class: scoped (C3, bug-fix).

State after PR #6004 (merged): the headline defect is fixed. run.mjs and setup-deps.mjs now take --data-dir, every documented invocation passes the substituted plugin data path, and an inherited data path is accepted only when it names this plugin. That resolves the data-directory finding (E1) and the misleading setup-deps message (Q2), and partly resolves the preflight finding (E3), the install-location override (I2) and the resolution-order finding (S2). The title now describes a fixed defect; what remains is listed below. Open question 5 in the body (whether to accept the data-directory finding at the research bar) is moot now that it has landed.

Still open, verified on current main:

• ${user_config.*} options appear only in spoke files the model opens with Read (output contract and source spokes), never in the SKILL.md body, so a configured library_dir, cookie file, JS runtime or concurrency value never reaches the pipeline.
• The ! preflight is still one compound block with no allowed-tools entry and no fallback line for when it does not run.
• The Bootstrap gate's STOP list still omits node dependencies, while the closing Prerequisites line says to stop on any failed prerequisite.

Basis: verified, PR #6004 body "Related" table; git show origin/main:plugins/knowledge/skills/video-digest/SKILL.md | grep -c user_config = 0 while context/output-contract.md has 7 and reference/sources/youtube.md 7, x.md 1; SKILL.md line 13 opens the ! block; lines 120 and 231 hold the two STOP rules.

Why a human: five open decisions remain. If the maintainer approves the recommended answers below, the item becomes scoped work an agent can pick up (flip to agent-ready + work-class: scoped + status: ready, drop needs-human and status: needs-decision).

Decisions for the maintainer

1. How userConfig options reach the pipeline. Options: (a) render each option once in the SKILL.md body, where Claude Code substitutes it, and have spokes refer to the rendered value; (b) another route. Also: severity high (auditor) or medium (review: defaults are unaffected). Recommended: (a), medium. Unblocks: configured library_dir, cookies, JS runtime and concurrency taking effect.
2. What happens when the node pipeline cannot run. Options: (a) add node dependencies to the Bootstrap STOP list and state that a hand-run of yt-dlp is not this skill's output; (b) also define a degraded mode with status: partial. Recommended: (a). Unblocks: predictable output instead of an unmarked hand-run.
3. How far data-directory resolution goes. fix(knowledge): resolve the plugin data dir explicitly instead of trusting the Bash env #6004 implemented the flag and the plugin-name check. Options: (a) stop there and document --data-dir under Prerequisites as the relocation override; (b) also implement the remaining .work/ and config-dir rungs of the on-demand-dependencies convention. Recommended: (a). Unblocks: operators who cannot write under the home directory.
4. Announcing the install target. Options: (a) the preflight script prints the resolved install path and how to relocate it; (b) document it under Prerequisites. Recommended: (a). Unblocks: users learning where the install goes before it happens.
5. Read-only readiness check. /knowledge:setup check cannot be invoked by the model. Options: (a) route the Prerequisites failure line to the single-command preflight script now and leave a knowledge:check skill to Epic: comprehension family, prerequisites contract and shared-code amendment #5835; (b) add knowledge:check now. Recommended: (a). Unblocks: a model-reachable readiness report.

Agent Brief

Type: Bug
Summary: Finish /knowledge:video-digest's readiness path after #6004: make the preflight a single runnable command, make userConfig options reach the pipeline, and stop cleanly when node dependencies are missing.

Current behavior:
The preflight is a compound ! block that worktree-isolated auto-mode sessions refuse, with no fallback. Every userConfig option lives in spoke text that arrives unsubstituted, so configured values are silently ignored. The Bootstrap gate does not stop on missing node dependencies.

Desired behavior:

• The preflight is one plain command that runs a check script by path with the substituted data directory, probes node dependencies, yt-dlp, ffmpeg, ImageMagick and faster-whisper, and always exits 0; it is pre-approved in allowed-tools, and Prerequisites says to run it by hand when the pre-computed context did not run. Confirm the command shape passes the worktree command-shape check before relying on it.
• Each userConfig option is rendered once in the skill body and spokes refer to the rendered value.
• The Bootstrap gate stops on missing node dependencies, printing setup-deps' failure text.
• Plus the decisions above, as approved.

Acceptance criteria:

• In a worktree-isolated auto-mode session the preflight command runs and prints a readiness report.
• An eval case sets a non-default library_dir and asserts the work root reaches the pipeline.
• With node dependencies absent, a watch or transcript run stops at Bootstrap and writes no hand-made artifacts.
• The video-digest test suite and /skill-quality:check pass.

Out of scope:

• Anything fix(knowledge): resolve the plugin data dir explicitly instead of trusting the Bash env #6004 already resolved (the --data-dir flag and plugin-name check).
• The same environment-read pattern in other plugins.