[ursuciprian]

Fixes the plugin directory's policy holds on plugin/ (validator run on 371b561).

Per hold

1. HOOK_GRANTS_PERMISSION (gate.mjs can approve). Nothing in the bundle can answer allow any more. In plugin mode a calibrated Jev answer, a System 2 approval, a human's queue approval and a workspace allowlist pass are a plain pass at the source (APPROVED in plugin.mjs); allowSetting, holdAllow and the allow emission are setup-only; claudeOut writes only a literal ask or deny. The bundled policy.json has no allow outcome, the Hermes adapter (its approve is an ask) is left out, and so are the queue approve, deny and clear CLIs. The build now fails on a permissionDecision other than a literal ask or deny, an approve action, or "allow" as a decision outside report.mjs and replay.mjs.
2. UNREAD_ASSET_REFERENCED. No icon in plugin.json, no PNG in the bundle.
3. Credential env beside a remote URL. Selfchecks and test doubles left out of the bundle (fake claude and codex CLIs, stub judge, infra, freeze and instructions selfchecks, doctor probes). Example hosts and documentation links removed, the OpenRouter referer header is setup-only, HELM_PASS renamed. No ANTHROPIC_API_KEY, REFLEX_KEYCHAIN_SERVICE or GH_TOKEN in the bundle (build check): the System 2 key comes only from the judge_api_key option.
4. COMMAND_SCRIPT_NOT_FOLLOWED. Commands run scripts/<name>.sh, plain sh scripts that refuse any argument the command does not list, then run one module with node. allowed-tools names those scripts; the gate judges each as the reflex command it stands for. The hooks and the MCP server still run node, so this hold is expected to stay for a reviewer.
5. RUNTIME_FETCH_EXEC. SKILL.md has no shell-pipe wording; the suggestion probes have no download text (curl is now forbidden everywhere in the bundle). The regexes in rules.json, detectors.json, injection policy.json, fastlane.mjs and autonomy.mjs stay: they are detection patterns.

Also left out: the reflex-sh shim, the queue.notify shell command, envelope set and clear, checkpoint restore, runaway reset. The plugin README gained reviewer notes.

Verification

• node scripts/build-plugin.mjs: OK, 62 files.
• claude plugin validate --strict plugin and .: passed.
• CLAUDE_PLUGIN_ROOT=plugin node test.mjs --plugin-only and npm test: green.
• Parity, keyless, scratch home: the 199 golden commands through the 371b561 bundle, this bundle and this checkout with --plugin give identical decision, source and rule.
• Local eval: golden.json 179 ok, 1 MISS, 19 over, identical to 371b561 (the MISS is the existing keyless one); golden-mcp.json 96 ok, 0 MISS on both.