feat(guardrails): add the identity-domain guard with domain classification and its kill switch

.changes/guardrails/feat-9743-identity-domain-guard-3f9a7c21.md

@@ -0,0 +1,7 @@
+---
+bump: minor
+---
+
+### Added
+
+- **`block-cross-domain`, a guard on the Bash and PowerShell row that classifies each call against a machine-local identity-domain map (#9743).** It reads `${CLAUDE_PLUGIN_DATA}/identity-domains.json`: `domains.<name>` with per-OS `roots`, `owners`, `identity_markers` and optional `gh_config_dir` and `az_config_dir`, then top-level `identity_files`, `shared_exceptions` and `messages`. It compiles the map with `jq` once per change into `identity-domains.cache` and reads that back with builtins, classifies the session cwd into the domain whose root holds it or neutral, and parses a command only when its text names a configured root or marker. It never denies a call: the result goes to the telemetry envelope (`cwd` and `form`, never a domain name), and a malformed map tells the user once per session. With no map it reads and parses nothing. The `block_cross_domain_enabled` option turns it off.

docs/catalog.md

@@ -105,7 +105,7 @@ plugin manifests and kept in sync by CI. Never hand-edit it; the category vocabu
 
 ## Security
 
-- [`guardrails`](../plugins/guardrails): Thirteen toggleable guards. Blocks: secret writes, machine paths, git hook bypass, force-push, reset --hard, merges with open review, drive-root /tmp writes, exported MSYS_NO_PATHCONV, recursive deletes of roots or outside the tree, shell-expanded commit -m, off-convention commit or PR titles; off by default, credential reads. Warns on: Workflow fan-out, direct gh pr create. Git hooks check commit subjects, secrets and paths, CLI flags, skill refs and removed paths.
+- [`guardrails`](../plugins/guardrails): Fifteen toggleable guards. Blocks: secret writes, machine paths, git hook bypass, force-push, reset --hard, merges with open review, drive-root /tmp writes, exported MSYS_NO_PATHCONV, recursive deletes of roots or outside the tree, shell-expanded commit -m, off-convention commit or PR titles; off by default, credential reads. Warns on: Workflow fan-out, direct gh pr create. Tracks identity domains. Git hooks check commit subjects, secrets and paths, CLI flags, skill refs and removed paths.
 
 ## Workflow
 

plugins/guardrails/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "guardrails",
-  "description": "Thirteen toggleable guards. Blocks: secret writes, machine paths, git hook bypass, force-push, reset --hard, merges with open review, drive-root /tmp writes, exported MSYS_NO_PATHCONV, recursive deletes of roots or outside the tree, shell-expanded commit -m, off-convention commit or PR titles; off by default, credential reads. Warns on: Workflow fan-out, direct gh pr create. Git hooks check commit subjects, secrets and paths, CLI flags, skill refs and removed paths.",
+  "description": "Fifteen toggleable guards. Blocks: secret writes, machine paths, git hook bypass, force-push, reset --hard, merges with open review, drive-root /tmp writes, exported MSYS_NO_PATHCONV, recursive deletes of roots or outside the tree, shell-expanded commit -m, off-convention commit or PR titles; off by default, credential reads. Warns on: Workflow fan-out, direct gh pr create. Tracks identity domains. Git hooks check commit subjects, secrets and paths, CLI flags, skill refs and removed paths.",
   "author": {
     "name": "Melodic Software",
     "email": "info@melodicsoftware.com"
@@ -66,6 +66,12 @@
       "description": "Comma-separated families block-credential-read permits: credential-fill, gh-auth-token, env-echo, credential-file-read. Empty, the default, blocks all.",
       "default": ""
     },
+    "block_cross_domain_enabled": {
+      "type": "boolean",
+      "title": "Block-cross-domain guard",
+      "description": "Reads a machine-local identity-domain map, identity-domains.json in the plugin data directory, classifies the session directory and each Bash or PowerShell command against it, and reports the result to telemetry; it denies nothing. With no map it does nothing. On by default.",
+      "default": true
+    },
     "block_unresolved_pr_merge_enabled": {
       "type": "boolean",
       "title": "Block-unresolved-PR-merge guard",