fix(guardrails): enablement probe honors local-only plugin scope

[kyle-sexton]

Summary

Audit f2 residual (#912; follow-up to #916 / PR #928): source_control_enabled() in flag-commit-pr-skill-bypass.sh counted a settings.local.json value only when the project settings.json already declared the same key. A plugin enabled ONLY at local scope — claude plugin install --scope local, a first-class state per the official plugins reference — therefore resolved as disabled, and the gh pr create advisory never fired (same silent false-negative class #916 fixed for user-global).

A local value now participates in per-key resolution unconditionally, matching the documented scope precedence (Local > Project > User). The two tests that encoded the old "a local-only key is ignored" model are inverted, plus a new local-only-enable-with-no-other-scope case.

Docs consulted per the fresh-docs mandate: settings scope precedence, --scope local.

guardrails 0.12.0 → 0.12.1 with CHANGELOG entry.

Test plan

• flag-commit-pr-skill-bypass.test.sh — 28/0 (red-first: 3 new/inverted local-scope cases)
• scripts/check-changelog-parity.sh --check-bump main — pass
• shellcheck clean

Related

• Closes guardrails: enablement probe ignores local-only plugin scope (settings.local.json without project key) #1045
• Refs audit: guardrails + source-control hardening — bypass gaps, convention-enforcement SSOT, decoupling #912 (audit umbrella, f2), fix(guardrails): enablement probe honors user-global plugin scope #916 / fix(guardrails): resolve source-control enablement across user-global scope #928 (user-global fix this completes)

🤖 Generated with Claude Code

[claude]

Claude encountered an error after 0s —— View job

---

I'll analyze this and get back to you.

[github-actions]

Warning

Automated review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/29959094311
• Last SDK result: {"subtype":"success","is_error":true,"num_turns":1,"duration_ms":377,"total_cost_usd":0}

Re-running the job, or pushing a new commit, will retry the review.

[claude]

Claude encountered an error after 0s —— View job

---

I'll analyze this and get back to you.

[github-actions]

Warning

Automated security review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/29959094461
• Last SDK result: {"subtype":"success","is_error":true,"num_turns":1,"duration_ms":391,"total_cost_usd":0}

Re-running the job, or pushing a new commit, will retry the review.