user-experience: reject dotfile team paths and add the plugin to fragment mode after its first release #6700

Refs: #6306

Problem

Two follow-ups from shipping the user-experience plugin in #6669. Neither blocks the plugin; part 1 is the only one that touches what it can read.

1. Team research paths accept dotfiles such as .env. plugins/user-experience/scripts/detect.mjs teamSettings() drops research_paths, persona_paths and output_home that escape the project or whose first segment is .claude or .git, checked as written and through symlinks (RESERVED at detect.mjs:293, reserved/resolvesReserved/usable at :307-319, with inside() for containment). A team file can still list .env (or .npmrc, .aws/…) as a research path. The job skills then read it as research data, so secrets could reach the model's context and a deliverable. Exposure needs the team's own committed file to name such a path.
2. user-experience is the one plugin missing from scripts/fragment-plugins.txt. Main moved every plugin to changelog fragments (chore(release): move the remaining 68 plugins to changelog fragments #6661) while feat(user-experience): add the user-experience plugin #6669 was open. Listing user-experience then failed FRAGMENT-MODE RELEASE on its initial 0.1.0 CHANGELOG heading, so it shipped unlisted (per-PR version bump still works). After its first release, add it (keep the list sorted) so later changes go through fragments like every other plugin.

Fix notes

• Part 1: extend reserved() (or a sibling predicate) to reject a first segment that is a dotfile or dot-directory, with an explicit allow-list if a real research folder needs one (decide the list; .claude-notes/ux style names must keep working, see the test "a path whose first segment only starts with .claude is kept"). Add a failing test in plugins/user-experience/tests/detect.test.mjs next to "team paths may not point into .claude or .git" for research_paths: [.env], persona_paths: [.aws/credentials] and output_home: .ssh/x, plus a symlink case. Mirror the refusal in the job skills' ## Deliverable output-home check if output_home is covered.
• Part 2: one-line add to scripts/fragment-plugins.txt; run scripts/check-changelog-parity.sh --check-bump origin/main and scripts/check-changelog-fragments.sh --check.

Acceptance criteria

• detect.mjs drops a research, persona or output path whose first segment is a dotfile not on the allow-list, with a warning, and the new tests fail before the fix and pass after; node --test 'plugins/user-experience/tests/*.test.mjs' passes.
• scripts/fragment-plugins.txt lists user-experience, and both changelog checks above pass.