feat(disk-hygiene): standing policy layers, leak-signature hints, OS auto-clean advisory

[kyle-sexton]

Closes #228 — post-ship follow-ups for disk-hygiene from a verified gap analysis of the shipped source against issue #160, docs/PLUGIN-PHILOSOPHY.md, and docs/MIGRATION-PLAYBOOK.md.

Changes

1. Leak-signature hints shipped in the baseline — .claude.json.tmp.* (failed atomic write), temp_git_* (agent Git scratch leaked outside a worktree), .pulumi-write-test-* (orphaned writability probe). These are the families feat: new plugin audit-artifacts — context-aware directory junk audit with tiered, gated cleanup #160 named as the plugin's reason to exist; all hint-only, discovery never authorizes removal. The README policy example no longer duplicates a baseline pattern.
2. Standing policy auto-discovery — without --policy, the engine layers ~/.claude/disk-hygiene.json (user-global) then <project>/.claude/disk-hygiene.json (passed as the new --project-dir scan argument, substituted from ${CLAUDE_PROJECT_DIR} in the skill body). Explicit --policy stays the invocation-specific choice and replaces both standing layers, per PLUGIN-PHILOSOPHY's configuration-ownership seam. Safe by construction: overlay application is additive-only (add protections, add hints, disable discovery hints), so ambient config cannot widen the destructive surface. Scan output records policy_sources; cross-layer duplicate hint IDs fail closed with the offending file named.
3. os_autoclean advisory (report-only) — extends the defer-to-the-owning-GC rule from products to the OS: when the audited zone overlaps the user temp directory, the scan reports the owning mechanism (Windows Storage Sense read from HKCU\...\StoragePolicy incl. the cadence=0 "low disk only" trap, systemd-tmpfiles on Linux) and recommends enabling it instead of hand-cleaning. Never blocks or authorizes anything.
4. Guard — exact scan shape extended for the optional --policy / --project-dir pair set; duplicates, unknown flags, and dangling values still fail closed.
5. Intent comment on validate_plan's native-GC eligibility gate: managed candidates are permanently report-only; the evidence exists so the report names a proven-runnable native command and ineligible managed state is never proposed.

Deliberately deferred (tracked in #228 with triggers): reversible Recycle-Bin/XDG-trash disposal (TOCTOU vs descriptor-anchored unlink), RELOCATE disposition, Windows/macOS execution lanes.

Verification

• test_hygiene.py: 50 passed, 4 platform skips (run on Windows). New coverage: standing-layer ordering and sources, explicit-policy replacement, cross-layer ID collision, non-weakening invariant, baseline leak signatures matching real leaked names, advisory zone logic, guard shape matrix.
• Existing tests isolated from developer machines' real standing policy files via a setUp patch.
• ruff check clean; whole-file ruff format deliberately not applied (baseline files are unformatted — formatting churn kept out of this PR). markdownlint clean on changed docs.
• Two new evals (standing-policy layering, OS-mechanism handoff).
• plugin.json bumped 0.1.0 → 0.2.0.

Fresh-docs mandate: verified this session against skills (${CLAUDE_PROJECT_DIR} substitution in skill body, v2.1.196+) and plugins reference (manifest schema, path substitutions), plus Configure Storage Sense and Policy CSP - Storage for cadence value semantics (0/1/7/30).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5c66075738

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".