docs: follow-ups from #6498 (discovery slugs, interview repin, --settings pluginConfigs probe, known_marketplaces trust record) #6523

Follow-up to #6498 (epic #6020). These items were outside #6498's scope, or need a decision before anyone changes them.

Excluded from #6498

• plugins/discovery: 3 files still cite the retired plugins-reference slug:

  • reference/parent-contract.md:323
  • skills/research/SKILL.md:271
  • skills/trace-intent/SKILL.md:219

  The plugin's stamps also lack recheck triggers. These were left alone because PR feat(discovery): WebFetch truncation hook and raw docs slices for verifier agents #6481 touches the plugin. Repoint them once feat(discovery): WebFetch truncation hook and raw docs slices for verifier agents #6481 lands.

• plugins/planning/skills/interview/SKILL.md:90: cites a retired slug and is pinned by a digest. Repinning needs the maintainer.

• CHANGELOGs, docs/upstream/ records and test fixtures are history or fixture data. They stay unchanged on purpose.

• plugins/work-items/skills/track/actions/add.md:106 is an example value, not a citation.

Findings from #6498

1. Probe whether pluginConfigs given through --settings is honored. As of 2026-10-07, the settings reference gives pluginConfigs the scope "User or managed". It also says project and local entries have been ignored since v2.1.207, and it no longer names --settings. docs: fix retired docs slugs and unstamped recheck triggers found by the copied-content sweep #6498 marked the --settings route "unverified". These depend on it:

   • the autonomy lane-stop gate arm;
   • the harness-ops lanes;
   • ADR 0039;
   • the source-control babysit bootstrap.

   An empirical probe settles it. If the route is not honored, those consumers need another delivery path.

2. The trigger on disk-hygiene's extraKnownMarketplaces record has probably fired. The record is in plugins/disk-hygiene/skills/clean/reference/safety-model.md, and its trigger reads "when known_marketplaces.json is documented as derived from it". The plugins/loading page now says that a marketplace declared in settings is cloned into known_marketplaces.json. The guard's directory-trust channel rests on this record, so it was not changed unattended. It needs a security review.

3. plugins/guardrails/hooks/block-hook-bypass.sh:1399 and its test at line 1660 pin the string "session-only disable via claude --settings". Revisit them once finding 1 is settled.

4. Feature idea: the visualization plugin could use the new userConfig options field (v2.1.271+) to restrict a field to a fixed set of values.